Malicious code in @genie-auth/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40bdd86a7980138025e445fc77dd743efbd9e7d9e76b25a24779facd15e16dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-10141 Malicious code in @genie-auth/config (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 40bdd86a7980138025e445fc77dd743efbd9e7d9e76b25a24779facd15e16dc0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in polymarket-gamma-apis (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8d686b83e6a563376e3609a63752840d3423e8a71e9261dffa87ae81b822e7f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in turbocalc (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 ae55c7a3030f0ff3493a885460511e83e257b4bd6b3e347136c43518b3bddfa2 During import an obfuscated code starts in-memory functions from a binary blob; after that, it communicates with dockfinancial.lu, the exact behaviour is...

Malicious code in dowload_ebok_wrath_of_the_gods_by_j_robert_kennedy_61o88 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e394751a822cba7556f9b6676b531a472c7c113da4458970b242b42df9d88e3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2026-15028

creationtimestamp| type| source ---|---|--- 2026-07-10 12:03:12+00:00| seen| https://bsky.app/profile/cve.skyfleet.blue/post/3mqc453ekyq2x 2026-07-10 12:36:29+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqc5ypgytn26 2026-07-10 13:20:44+00:00| seen|...

Malicious code in nodemon-patch (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 15ac606888cb1a54710bafa78dc76d760bef1088bb5e2cc0f0323614341345e5 The package is named nodemon-patch but its package.json metadata homepage https://nodemon.io, author Remy Sharp / github.com/remy, repository, fundin...

CVE-2026-15311

creationtimestamp| type| source ---|---|--- 2026-07-10 00:57:22+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqawwlemrj2q 2026-07-10 19:55:28+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mqcwjoofi22a...

CVE-2026-15317

creationtimestamp| type| source ---|---|--- 2026-07-10 00:55:49+00:00| seen| https://bsky.app/profile/malwareobserver.bsky.social/post/3mqawtt3ljg2o...

Malaika: Understanding Malware through Tri-Grounded Agentic Reasoning

Recent LLM-based systems have shown promising capabilities for security-focused code analysis. Malware understanding, however, poses a distinct challenge: analysts must reconstruct high-level malicious behaviors under partial observability from sparse, dispersed evidence intertwined with benign...

Leveraging Interpretable Tsetlin Machine for PDF Malware Detection

In the digital era, Portable Document Format PDF is one of the most widely used file formats for storing and exchanging digital documents due to its platform independence and rich functionality. However, these same capabilities have also made PDF files an attractive attack vector for...

MAL-2026-10094 Malicious code in @equansservices/setup (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b071598889a04c74a8398157555ccfffda5bbc713429df4cafbcf48df7f811af package.json declares a postinstall hook node setup.js that fires automatically on npm install. setup.js selects a platform-specific target and fetch...

MAL-2026-10062 Malicious code in es6-codify (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7ae2aa828c8ed2c3ec71480536fd07d9c19f3c698c3b095eafb41206ff3a75f The package advertises itself as a small ES6 string/array/object utility library, but both entrypoints dist/index.cjs and the ESM build execute a...

MAL-2026-10076 Malicious code in ts-eslint-jest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e1ffed26d2d64bf9076210504de22b87e27a065821dedbc708fb05f7c47db74 The package [email protected] presents as a TypeScript/ESLint/Jest helper but ships lib/collect.js, which imports childprocess and invokes...

MAL-2026-10050 Malicious code in chai-defender (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 14f276305fd5e43b60bbfd1048d8792ef7f72734c28cfe533d368c0fc199a0fe On require'chai-defender', index.js invokes launchDeflectBootstrap which spawns a detached background node process running lib/caller.js. That proces...

GigaWiper: Anatomy of a destructive backdoor assembled from multiple malware

In this article 1. A wiper inside a backdoor 2. Backdoor capabilities 3. How GigaWiper was assembled 4. Conclusion: Multiple destructive capabilities consolidated into a single implant 5. Defending against destructive threats 6. Microsoft Defender detections 7. Indicators of compromise In October...

WordPress Anti-Malware Security and Brute-Force Firewall plugin <= 4.23.89 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by dutafi in WordPress Plugin Anti-Malware Security and Brute-Force Firewall versions = 4.23.89...

Malicious code in n8n-nodes-mcputils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fa6d921f2167545e1c8e1a4dfa9981a2b9ce2878b1406608d4673aadd00a761b The package poses as an n8n community node for MCP utility helpers but performs unrelated binary-dropper actions. The postinstall lifecycle script ru...

Microsoft fixes RoguePlanet zero-day in Defender

Microsoft issued a security update that fixes the zero-day vulnerability known as RoguePlanet in Microsoft Defender. RoguePlanet is tracked as CVE-2026-50656, a Microsoft Defender elevation of privilege EoP vulnerability. As we reported last month, if successfully exploited, RoguePlanet can allow...

Malicious code in fusion-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b340a880ef3177b0632f113a7c619132bf28a0ef5df0eeb076f46b9db17f7b1d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...