A week in security (August 31 – September 6)

Last week on Malwarebytes Labs: The hidden work of modernizing Malwarebytes X Money rollout linked to password-reset attacks Free streaming boxes may be routing criminal traffic through your home StreamRat Android malware spreads through Meta and TikTok ads Your phone or computer may soon ask how...

Malicious code in base-account-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ae6343291a1e909323f40cb39c63de633e733d3a7ca24827d35ff2d960f9e6a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16038 Malicious code in scw-mobile (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f92fe2c0fe1acd783b5612c30ba1976c68c421b6451a68d150928e5166c362e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in scw-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4e609dfddbc549c740b78ea2dfcc4dc218584bdb695d1967e49e262c3ed2fb8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in base-app-data (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 385b3732590f10aba4436505fecbd325128919df56f33c060ef3f9f557ead91f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-16028 Malicious code in cb-wallet-env (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 86afbbd47bbbe39fd4f8d9f4146149d70fbb46777c17eebf0c52fd6cef1fef8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PT-2026-95055

A new version of the greentic-setup-dev crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup-dev was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal...

PT-2026-95056

A new version of the greentic-setup crate was published with a variant of the PolinRider malware included that would fire when a project depending on greentic-setup was opened in Visual Studio Code. One malicious version was published on 2026-09-06, approximately 27 hours before removal. This cra...

Malicious code in @liuliang520500/sinataoke_cn_test (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3049eff160660fee9030ad57663083c1171a4e69c84b4f234660420d124c5c82 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15959 Malicious code in @liuliang520500/pdd-sdk-new (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8a7499d71351fb91827b6e69cbea52e9a4cd6b3802693d0b4f1b545700e8ad8e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @liuliang520500/jd-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b68e3cfe0548d1118ec047bea15f3bb902fcb9db0816251df440e2e2326a5382 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in array-frames (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dd9461945c1bccc858c52f79e13624b33fb8cdfc37c889de48907b8464779063 The npm package [email protected] advertises a trivial array chunking utility but ships an obfuscator.io-wrapped payload as its main module. On...

Malicious code in @domyjs/throttle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 99fe66f1096277c1fc4cfea3b2965e728cc128aad9cd21a571b1a5b8dac45c6c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-15955 Malicious code in @domyjs/router (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6506d9bb7ba386d56ee4e9f326482fd887e63e1b7ebe674f8df34c8c75cf1b1c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @domyjs/reactive (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c86a74d6abacb40b6cb20058f59cddbd922321b2d60793106da7c6cecf32055f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @yoannchb/cattract (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e7abd13f1aa830b5721234537a3e473c8c59527506f8a0daeca72bc17c6e55 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in linkpreview-simple (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c62818bdb74e00433e1e82737807bc3c427fdcca8db39d1fff7bf6db5e7e64d5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in json-into-html (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04a5353fa099a8aecf0c34fd2d34244cc86058adb2f9a26eee4d7efe08a5b95f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in memov (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1aaa3b673c4d7a90e08673fc3dd2ebbc087fe5605238d11e2f4cdfced195d63a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in chrome-speech-recognition (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6595849dd7059a8fb61024bf33c2c11704cb52a784f6449cf940dc17725a0208 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...