66782 matches found
Malicious code in minecc (PyPI)
Source: checkmarx 346324e80b7fdd082fd9c18592544f6f9f0e19e036d4f8ea73ecf1274e7ab426 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...
Malicious code in libpywramgrand (PyPI)
Source: checkmarx 416f5a7ac259bc6371a0966dde66e31e7497662085958c78cadfa7bc72919b6a EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...
Malicious code in libcandyintelvisa (PyPI)
Source: checkmarx 1a66d5d6fc74aa2df237c71269e7db605de1bc9e1d80b7678867bc3ee63f8f87 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...
Malicious code in esqstringramgui (PyPI)
Source: checkmarx 3d945c815717e70dad051c66a2654794041dd4e3405fe438e703518a890788e0 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...
MAL-2026-10980 Malicious code in nolby (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a8bc0fa5eb23a45d27933ce1d32b7fabed27182039e170dbcaa38c0462dfa20 The package advertises itself as a pure calendar/streak math library with no import-time side effects, but index.mjs invokes a top-level sync on modu...
What happens if you visit a WordPress site hacked through wp2shell?
WordPress has patched a serious core vulnerability chain known as wp2shell, and site owners are understandably focused on updating their own sites. But there’s another question worth asking: what happens to ordinary visitors when they land on a compromised site? Because a hacked website becomes a...
CVE-2026-16408
creationtimestamp| type| source ---|---|--- 2026-07-21 14:11:13+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr5yga5vpe2q 2026-07-21 14:12:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5yj722mj2u 2026-07-21 21:00:06+00:00| seen|...
CVE-2026-16445
creationtimestamp| type| source ---|---|--- 2026-07-21 14:08:12+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5yatv4py2e 2026-07-21 14:40:38+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mr622tzdcl23...
GHSA-Q5FW-VPQC-FGPH
creationtimestamp| type| source ---|---|--- 2026-07-21 13:18:24+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5vhspcma2g...
GHSA-FV8Q-RWJ8-2C55
creationtimestamp| type| source ---|---|--- 2026-07-21 13:15:17+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr5vc7infg2e...
New ClickLock Stealer locks your Mac until you hand over your password
ClickLock Stealer is a new, modular macOS infostealer delivered via ClickFix-style phishing pages that can lock a victim’s Mac, steal their macOS password, browser and password manager data, cryptocurrency wallets, and then leave behind a persistent backdoor. The malware was discovered by Group-I...
Malicious code in chai-leaf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...
MAL-2026-10940 Malicious code in chai-leaf (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 77cc7562a27df348fafc455124fd845dfc2e5774c42279ee6e3dd8f1cfb1f05b [email protected]'s main entry index.js unconditionally requires./lib/config, which is a single 3,546,568-byte obfuscator.io-encoded file 20,721-entry...
MAL-2026-11001 Malicious code in date-format-utils-xz (npm)
The npm package date-format-utils-xz masquerades as a date-formatting utility but is malicious. Its own decoy index.js is prefaced with a Chinese comment translating to "disguised as a normal date formatting tool." Every published version 1.0.0-1.0.4 declares a postinstall lifecycle hook...
GHSA-GCJP-F7JM-RRRG
creationtimestamp| type| source ---|---|--- 2026-07-20 19:01:01+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mr3y5jeb5l2e...
FakeGit Campaign Uses 7,600 GitHub Repositories to Spread SmartLoader Malware
Cybersecurity researchers have discovered nearly 7,600 malicious GitHub repositories, out of which more than 800 pose as artificial intelligence AI skills or Model Context Protocol MCP servers to deliver a malware family known as SmartLoader as part of an ongoing campaign codenamed FakeGit...
Exposed Server Reveals AI-Assisted Phishing Toolkit Behind WebDAV Malware Campaign
A malware operator left its delivery server wide open, and Rapid7 pulled down the whole toolkit: 1,048 files spanning lure templates, filename-spoofing tests, execution experiments, droppers, builder notes, and two campaign chains. One was already live against Windows users in Mexico, delivering ...
Malicious Package
Overview OpenAI-Core is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorshi...
Malicious Package
Overview Nemesis.Essentials.Net is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this packag...
