Malicious code in @walknpm/todo-cli (npm)

@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with...

Malicious code in dsh-plugin-blender-3d (npm)

[email protected] is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to...

Malicious code in @walknpm/todo-cli (npm)

@walknpm/[email protected] is a new release of a todo-list CLI and web app whose only change from 2.0.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to /tmp/.smh; as root or with...

Malicious code in dsh-plugin-blender-3d (npm)

[email protected] is a new release of a DeepSeek Harness plugin for Blender 3D modeling whose only change from 0.2.0 is a postinstall script, sh scripts/miner.sh, that runs on npm install. The script downloads a gzip carrier from amplify-gursha-dev-121835-deployment.s3.amazonaws.com to...

MAL-2026-15901 Malicious code in net-util-y8 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d1e81ce327647324756e0ea15d1016d45cd5bb092dd0099418ba2db59eca98a7 The package has no real functionality: index.js contains only an empty comment and package.json declares no exports or lifecycle scripts. The...

MAL-2026-15878 Malicious code in cbc97b7a (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7d772b04ff3be605aae9022f0462b9834f488dbb6c1397b7cc1075bb68db63c0 The tarball ships only package.json with no code, scripts, main, or bin. The description field contains a 41KB base64-encoded POSIX shell script that...

MAL-2026-5529 Malicious code in v018-axios-cdntest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d30d2c9939173663f8ba1312b2591d2f86c67657bd5eeff59b19187f50b901 Package impersonates axios v0.18.0 index.js carries the genuine axios v0.18.0 | c 2018 by Matt Zabriskie header and sets window.axios=,...

Malicious code in v018-axios-cdntest (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 67d30d2c9939173663f8ba1312b2591d2f86c67657bd5eeff59b19187f50b901 Package impersonates axios v0.18.0 index.js carries the genuine axios v0.18.0 | c 2018 by Matt Zabriskie header and sets window.axios=,...

Over 1,000 Exposed ComfyUI Instances Targeted in Cryptomining Botnet Campaign

An active campaign has been observed targeting internet-exposed instances running ComfyUI, a popular stable diffusion platform, to enlist them into a cryptocurrency mining and proxy botnet. "A purpose-built Python scanner continuously sweeps major cloud IP ranges for vulnerable targets,...

CVE-2017-20210

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research...

CVE-2017-20210

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research...

CVE-2017-20210

QNAP Photo Station is vulnerable to a security issue related to XMR mining programs , as identified by internal research. This vulnerability affects versions prior to 5.4.1 and 5.2.7 . Impacting multimedia organization on QNAP NAS, the flaw allows for unauthorized mining activity. Remediation is ...

CVE-2017-20210 Photo Station

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research...

CVE-2017-20210 Photo Station

Photo Station 5.4.1 & 5.2.7 include the security fix for the vulnerability related to the XMR mining programs identified by internal research...

PT-2025-46316

Name of the Vulnerable Software and Affected Versions Photo Station versions prior to 5.4.1 Photo Station version 5.2.7 Description The software contains a security issue related to XMR mining programs. Internal research identified this issue, and versions 5.4.1 and 5.2.7 include a security fix...

QNAP Systems Photo Station security vulnerability

QNAP Systems Photo Station is an online photo album from China-based QNAP Systems, Inc. It is used to organize multimedia content photos and videos on Qnap Nas. A security vulnerability exists in QNAP Systems Photo Station versions 5.4.1 and 5.2.7 that stems from a security issue related to the X...

EleKtra-Leak Cryptojacking Attacks Exploit AWS IAM Credentials Exposed on GitHub

A new ongoing campaign dubbed EleKtra-Leak has set its eyes on exposed Amazon Web Service AWS identity and access management IAM credentials within public GitHub repositories to facilitate cryptojacking activities. "As a result of this, the threat actor associated with the campaign was able to...

Cryptojacking Group TeamTNT Suspected of Using Decoy Miner to Conceal Data Exfiltration

The cryptojacking group known as TeamTNT is suspected to be behind a previously undiscovered strain of malware used to mine Monero cryptocurrency on compromised systems. That's according to Cado Security, which found the sample after Sysdig detailed a sophisticated attack known as SCARLETEEL aime...

BitRAT Now Sharing Sensitive Bank Data as a Lure

Introduction In June of 2022 Qualys Threat Research Unit TRU wrote an in-depth report on Redline, a commercial off the shelf infostealer that spreads via fake cracked software hosted on Discord’s content delivery network. Since then, we have continued to track similar threats to identify their...

Microsoft Warns of Cryptomining Malware Campaign Targeting Linux Servers

A cloud threat actor group tracked as 8220 has updated its malware toolset to breach Linux servers with the goal of installing crypto miners as part of a long-running campaign. "The updates include the deployment of new versions of a crypto miner and an IRC bot," Microsoft Security Intelligence...