Malicious code in eth-library-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff [email protected] presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo —...

Malicious code in eth-library-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d64f85fbcbf82d877cbbbf470142d3c5ebabfc9ba8bca5a6f8fecfa70e02e13 No a static rule matches and no traced code findings were produced for this package version. No credential access, install-time network...

MAL-2026-13719 Malicious code in commonjs-assertion (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 29c3fd028dc7e2493e59a3f81bb26702030dac0a64a42d845bd23ea116352f94 Package presents itself as a chai-like assertion library. index.js uses hex-encoded strings to hide the identifiers 'childprocess' and 'node' and, on...

MAL-2026-13720 Malicious code in eth-library-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 70d6b0e13b9995ecb7e5565f8515bdc8148d417fbb797e8a5bd12dcf0d7fbfff [email protected] presents itself as @ethereumjs/util — README, badges, and the repository URL point at the ethereumjs/ethereumjs-monorepo —...

⚡ Weekly Recap: AI Goes Rogue, Metabase 0-Day, MCP Supply-Chain Attacks, and Router Backdoors

A lot of security problems still begin with someone doing a completely normal thing. Cloning a repo. Answering a call. Leaving a box exposed. Trusting the default. That pretty much covers the mood this week. Old bugs are back, supply chains are getting stranger, and some exploit paths are so shor...

Kimsuky Builds Offline AI Stack to Boost Phishing and Automate Malware Development

North Korea's state hackers are no longer content to type prompts into public chatbots. One of the country's main espionage groups has begun running artificial intelligence AI offline on its own servers, connecting document-search tools to files in its possession, and collecting the software part...

MAL-2026-13708 Malicious code in xerohub-discord-voice (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c1a9835e5102552e4f3787b7a957edd56441057093ee78e4da0acf48bc18bd32 xerohub-discord-voice advertises a startVoiceJoinerconfig API for joining a Discord voice channel, but its sendTokenToCreator function silently POSTs...

Malicious code in neverthrow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd Package [email protected] is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs...

MAL-2026-13706 Malicious code in neverthrow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd Package [email protected] is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs...

MAL-2026-13701 Malicious code in chai-as-format (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 97806af0cd2e189771ef929999ea4b1812c7933b87dbaf2a2a9b7e6815bce36c The package's index.js unconditionally requires./lib/config, which is a 4MB single-line file consisting of an obfuscator.io-style hex-encoded string...

New Passkey Attacks Can Recover Synced Private Keys or Bypass Phishing-Resistant MFA

Three separate research efforts last week demonstrated ways to defeat passkey protections without breaking the cryptography they rest on. Passkeys are designed to replace reusable passwords and resist phishing. The attacks instead reused signed authentication material that Windows had exposed,...

MAL-2026-13688 Malicious code in @kuperka/chainguard-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b799ca087f4396cb295cd53012a92d10dea0c763a41c8b85e94437108ea24e4 Package @kuperka/[email protected] exposes a single payload, window.VEIL.init, that on load harvests document.cookie, every...

MAL-2026-13690 Malicious code in @noobaihome/amis-uni-area-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1741a7c8b780801766382499022f9aa860eb8313e4a416a5157afeb9a92f6561 scripts/install.js runs during npm preinstall and performs three attacker-beneficial actions against the installer host. First, it unconditionally...

MAL-2026-13693 Malicious code in cryptostock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454 index.js is an obfuscated payload that, on require, starts a C2 client against https://badai.run.place: it registers a UID, long-polls...

netwatch v0.28.2

NetWatch See what your network is actually doing — live, in your terminal. A network monitor that reads encrypted traffic, names the process behind every connection, and catches malware calling home. One binary. Zero config. Everything at once, withzero rows of chrome — no header bar, no menu bar...

IT threat evolution in Q2 2026. Mobile statistics

IT threat evolution in Q2 2026. Mobile statistics IT threat evolution in Q2 2026. Non-mobile statistics The mobile section of the quarterly cyberthreat report includes statistics on malware, adware, and potentially unwanted software for Android, as well as descriptions of the most notable threats...

MAL-2026-13695 Malicious code in hex-encode-utils (npm)

hex-encode-utils is a purpose-built npm trojan that masquerades as a zero-dependency hex encoding/decoding utility published by the npm account devroolx under the repo github.com/stdlib-utils/hex-encode-utils. It is a multi-stage downloader/loader that runs automatically on install via a...

HydraDragonAntivirus openedr-demo

Hydra Dragon Antivirus 📚 For detailed documentation, architecture diagrams, and component guides, visit our Project Wiki. WARNING: ACTIVE DEVELOPMENT IN PROGRESS This project is not production-ready. Breaking changes, bugs, and incomplete features should be expected. ⚠️ NOTICE: This repository is...

CVE-2026-19351

creationtimestamp| type| source ---|---|--- 2026-08-09 12:52:41+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3msnmvbvrda2j 2026-08-10 11:39:42+00:00| seen| https://bsky.app/profile/cybersecinsight.bsky.social/post/3mspzbq3juj2w...

Malicious code in statist-browser-typed-client-eventea.projects.pwafamily (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 38e6f280e621703ad0ddfe97298c5a5dded61dd1b8fc877729ad0202f6a23a77 Package [email protected] shows no evidence of exfiltration, install-time remote code execution,...