Malicious code in vectormark (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d0646473c841676e2f55d66494a805943e00b2e2d7515e1bbba5453e6a9024e [email protected] advertises itself as a zero-dependency SVG helper library, but index.js exports an undocumented function getPlugin that issues an...

CVE-2026-61391

creationtimestamp| type| source ---|---|--- 2026-07-22 15:15:31+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mrami5nycm2j...

Why Modern SOCs Need Multi-Layered Detections

The cycle is over. For years, cybersecurity followed a familiar pattern: defenses improved, attackers adapted, and the back-and-forth continued. Today, AI-equipped attackers are simply outpacing defenses. Most intrusions now bypass endpoint and malware-based detection entirely. The CrowdStrike...

Small, Free, and Effective: Orchestrating Open-Weight Small Language Models to Outperform Single LLM for Malware Analysis

Malware analysis demands rapid interpretation of complex detonation reports spanning filesystem, network, and process behaviours. While large language models LLMs demonstrate impressive capabilities for technical artifact interpretation, the opacity and escalating API costs of closed-weight...

Taming the Security-Energy Paradox: A Green AI Approach to Optimized Android Malware Detection

An increase in advanced Android malware requires the use of deep learning models, which can run on Android devices. But there is a trade-off between security and energy use, as strong detection models can drain the battery of devices fast. This work tests different Multi-Layer Perceptron MLP mode...

Malicious code in streak-daycount (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f787426dd4d04d5cd527bdb19d309c64de82e252af4af0714dc33b07a26b73b0 [email protected] ships an index.mjs whose top-level async IIFE runs on import. When the host is Linux and NODEENV is not 'production', the code...

MAL-2026-10981 Malicious code in streak-calendar (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 423bee6d856bd804061bf56f9b8f57f6cbbc0e503ab82c572f539b2f317c30e3 index.mjs contains a top-level async IIFE that fires when the module is imported. When running on Linux with NODEENV!= 'production' and a WSL-style...

Malicious code in tprelibpost (PyPI)

Source: checkmarx eef860542870f41cd93fe5dce25dfa9e6476b898889f085fc1f522955bbcac6e EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in tppaypalver (PyPI)

Source: checkmarx 8fe1c611b20ea153bb8216eca206317a8cccdcdeb862f1c1cc82c8062070a6d4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in minecc (PyPI)

Source: checkmarx 346324e80b7fdd082fd9c18592544f6f9f0e19e036d4f8ea73ecf1274e7ab426 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in libpywramgrand (PyPI)

Source: checkmarx 416f5a7ac259bc6371a0966dde66e31e7497662085958c78cadfa7bc72919b6a EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in libcandyintelvisa (PyPI)

Source: checkmarx 1a66d5d6fc74aa2df237c71269e7db605de1bc9e1d80b7678867bc3ee63f8f87 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in esqstringramgui (PyPI)

Source: checkmarx 3d945c815717e70dad051c66a2654794041dd4e3405fe438e703518a890788e0 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

MAL-2026-10980 Malicious code in nolby (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...

What happens if you visit a WordPress site hacked through wp2shell?

WordPress has patched a serious core vulnerability chain known as wp2shell, and site owners are understandably focused on updating their own sites. But there’s another question worth asking: what happens to ordinary visitors when they land on a compromised site? Because a hacked website becomes a...

CVE-2026-16408

creationtimestamp| type| source ---|---|--- 2026-07-21 14:11:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5yga5vpe2q 2026-07-21 14:12:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5yj722mj2u 2026-07-21 21:00:06+00:00| seen|...

CVE-2026-16445

creationtimestamp| type| source ---|---|--- 2026-07-21 14:08:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5yatv4py2e 2026-07-21 14:40:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr622tzdcl23...

GHSA-Q5FW-VPQC-FGPH

creationtimestamp| type| source ---|---|--- 2026-07-21 13:18:24+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5vhspcma2g...

GHSA-FV8Q-RWJ8-2C55

creationtimestamp| type| source ---|---|--- 2026-07-21 13:15:17+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5vc7infg2e...

New ClickLock Stealer locks your Mac until you hand over your password

ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor. The malware was discovered by Group-I...