tirith v0.4.0

tirith Your browser would catch this. Your terminal won't. Website | Docs | SKILL.md | Changelog Independent open-source project, with hosting supported by the Vercel Open Source Program Spring 2026 Cohort. Can you spot the difference? root@kitploit: curl -sSL https://install.example-cli.dev | ba...

MAL-2026-13010 Malicious code in bnpl-blocks-mobile-bnpl-title (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5cf4f269562c9f3d9dd234e8c38b6d3408b636a4e743a6106dff730efce473ce On require of the package, index.js loads support.js, which selects a per-platform binary path, downloads bytes from a pool of obfuscated Cloudflare...

Malicious code in bpm-foundation-testing (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 731f1d13e5958a2b7954d0c472f56bae0663ebc6e0d0e1f2e7c080b70f124c73 index.js unconditionally requires./platform on load. platform.js selects a per-OS payload path, fetches bytes from one of three...

MAL-2026-12534 Malicious code in cardsmobile-notifications (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5a75c5659b227cbea7e622e9c5613594e590fae0580db08420e9f2493b2fd3d2 On require of cardsmobile-notifications, index.js loads support.js which fetches an OS/arch-specific executable from a rotating list of obfuscated...

Malicious code in devplatform-api-v1-endpoint (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f2ed0defa1fbae571985664baae47d89d796f943b249115eb73a38edce04fb6c On require, adapter.js selects a platform-specific asset path and fetches an executable from string-split-obfuscated hosts under...

Malicious code in devplatform-hooks (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 03e653399f20fec2b4b40c7c8921090939a1205110d866d23e4b605802cbc75d On require of devplatform-hooks, index.js loads init.js, which selects a platform-specific payload URL and fetches an executable from obfuscated...

Malicious code in devplatform-spa-plugin-s3-module-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1a4f4ab19296a9ece2741e6f813780cbdc84d5f7fe188024ad2deb51aa97b5a On require of the package's main entry, index.js loads adapter.js, which selects a platform-specific payload URL, fetches opaque bytes from one of...

MAL-2026-12779 Malicious code in devplatform-spa-plugin-s3-module-loader (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b1a4f4ab19296a9ece2741e6f813780cbdc84d5f7fe188024ad2deb51aa97b5a On require of the package's main entry, index.js loads adapter.js, which selects a platform-specific payload URL, fetches opaque bytes from one of...

Malicious code in zod-pino444 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 560c3d47344d4da5dffac230236b5248d2f1856c221ffac7ff72d4e3b197957b Package [email protected] is a credential/secret harvester disguised behind a benign-sounding name. scripts/postinstall-agent.mjs is a...

Malicious code in requests-enhancer (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0f61f1a905e0ec1bb593f7b20d4f9a8a9e72deeb16440f72acbcaf00aeab1cd On import requestsenhancer, the package's init.py spawns a daemon thread that runs pip install...

EUVD-2019-10538

Malware in sbrugna...

Microsoft Flags AI-Driven Phishing: LLM-Crafted SVG Files Outsmart Email Security

Microsoft is calling attention to a new phishing campaign primarily aimed at U.S.-based organizations that has likely utilized code generated using large language models LLMs to obfuscate payloads and evade security defenses. "Appearing to be aided by a large language model LLM, the activity...

AI vs. AI: Detecting an AI-obfuscated phishing campaign

Microsoft Threat Intelligence recently detected and blocked a credential phishing campaign that likely used AI-generated code to obfuscate its payload and evade traditional defenses. Appearing to be aided by a large language model LLM, the activity obfuscated its behavior within an SVG file,...

Leveraging LLM to Strengthen ML-Based Cross-Site Scripting Detection

According to the Open Web Application Security Project OWASP, Cross-Site Scripting XSS is a critical security vulnerability. Despite decades of research, XSS remains among the top 10 security vulnerabilities. Researchers have proposed various techniques to protect systems from XSS attacks, with...

Fake Proof-of-Concepts used to lure security professionals

Researchers from the Leiden University published a paper detailing how cybercriminals are using fake Proof-of-Concepts PoCs to install malware on researchers' systems. The researchers found these fake PoCs on a platform where security professionals would usually expect to find them--the public co...

CVE-2019-1981 Cisco Firepower Threat Defense Software NULL Character Obfuscation Detection Bypass Vulnerability

A vulnerability in the normalization functionality of Cisco Firepower Threat Defense Software, Cisco FirePOWER Services Software for ASA, and Cisco Firepower Management Center Software could allow an unauthenticated, remote attacker to bypass filtering protections. The vulnerability is due to...