Malicious code in turbom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64978153f8a987180b6c8e88b5787598ed949a604527f0098271f97d8c66a235 Starting version 1.0.1, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

MAL-2026-7015 Malicious code in turbom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 64978153f8a987180b6c8e88b5787598ed949a604527f0098271f97d8c66a235 Starting version 1.0.1, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

MAL-2026-6999 Malicious code in luludawang-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae96a2ee83d724de0e046dbf9e4749e9fd0d5c56fc16f2f28050512080f30628 On npm install, the package's postinstall hook runs index.js, which reconstructs a remote URL...

MAL-2026-6984 Malicious code in @vite-ln/build-ts (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8972bbfdd55ad200dd49b08501d7391beca99841f0c36479806f2b1e329950a2 Package @vite-ln/build-ts copies the legitimate vite package's manifest verbatim description 'Native-ESM powered web dev build tool', author 'Evan...

Malicious code in turbod (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78d60e25c1258021c4fb69a93456c76ef1157be852c7b9dc7165290ca599b0f7 Starting version 1.0.7, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

MAL-2026-6979 Malicious code in turbod (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 78d60e25c1258021c4fb69a93456c76ef1157be852c7b9dc7165290ca599b0f7 Starting version 1.0.7, the package contains obfuscated code and embedded binary that is executed during the import, sharing many similarities with package...

Malicious code in oxntime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4d96d9d5b1800042c94a33b8ac459abe42775a2c07e7cbd4ca2f689bdcf141ef The package contains obfuscated code and embedded binary that is executed during the import. The embedded binary targets Android and seems to act as a guard fo...

MAL-2026-6975 Malicious code in oxntime (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 4d96d9d5b1800042c94a33b8ac459abe42775a2c07e7cbd4ca2f689bdcf141ef The package contains obfuscated code and embedded binary that is executed during the import. The embedded binary targets Android and seems to act as a guard fo...

picklescan missing detection by simple obfuscation of a `builtins.eval` call

SummaryAn unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the host loading a pickle payload from an untrusted source. DetailsIt's possible to hide the eval call nested under another callable via getattr. PoCpythonimport builtinsclass EvilClass:...

PYSEC-2026-1789 picklescan missing detection by simple obfuscation of a `builtins.eval` call

Summary An unsafe deserialization vulnerability allows any unauthenticated user to execute arbitrary code on the host loading a pickle payload from an untrusted source. Details It's possible to hide the eval call nested under another callable via getattr. PoC python import builtins class EvilClas...

Malicious code in zod-pino444 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 560c3d47344d4da5dffac230236b5248d2f1856c221ffac7ff72d4e3b197957b Package [email protected] is a credential/secret harvester disguised behind a benign-sounding name. scripts/postinstall-agent.mjs is a...

Malicious Package

Overview @bytemend/mfebus is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code. This package contains malicious code and was identified as part of the PolinRider supply chain campaign, linked to North Korean threat actors associated with the Contagious Interview/Famous Chollima activity...

Malicious Package

Overview @apexcraft/nano-key is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallet...

Malicious Package

Overview @gleamkit/probe is a malicious package. This package contains malicious code and is part of a coordinated npm supply-chain campaign. It ships an obfuscated postinstall payload that downloads and executes a Rust-compiled infostealer binary. Impact The infostealer targets crypto wallets,...