Adversarial Robustness in Smishing Detection: A Comparative Analysis of Adversarial Fragility in Classical Vs. Transformer-Based Detection Systems

Smishing detection systems are commonly trained and evaluated on clean, monolingual text. In low-resource settings, however, attackers frequently circumvent these systems through character obfuscation, cross-lingual code-switching, and structural perturbation. This study evaluates adversarial...

MAL-2026-13921 Malicious code in envpack-conf (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a061ac72b9e392fee182ad4873aab0cc9a64694a11228438a7838343b96d338f envpack-conf 1.0.1 is a trojanized copy of the pkg-conf utility. index.js appends a top-level async IIFE that runs whenever the module is imported. T...

MAL-2026-13706 Malicious code in neverthrow-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b58633ada4ac777e5a404d3fa38bc1e664cb4696ccffcfd010a9552b1605cbd Package [email protected] is a typosquat of the legitimate neverthrow library. package.json declares postinstall: node./dist/install.js, which runs...

MAL-2026-13688 Malicious code in @kuperka/chainguard-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b799ca087f4396cb295cd53012a92d10dea0c763a41c8b85e94437108ea24e4 Package @kuperka/[email protected] exposes a single payload, window.VEIL.init, that on load harvests document.cookie, every...

MAL-2026-13696 Malicious code in postcss-initial-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e88db5eb44ddcfa3cd22d46e8b6e6a1cd2e7da25a5942d35550d50f2cbbb9ea3 index.js contains a unicode-escape-obfuscated block that runs when the package is required. It queries public Ethereum RPC endpoints 1rpc.io/eth,...

MAL-2026-13693 Malicious code in cryptostock (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9ab293d041a75fa4fcfb65c996176a885720e7b60cf3dde4b19154c073c29454 index.js is an obfuscated payload that, on require, starts a C2 client against https://badai.run.place: it registers a UID, long-polls...

MAL-2026-13685 Malicious code in pytablute (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 89c8605077eecd12f249b3698da0cc2b60f54ecca01041a16221882d1ee6a4b1 Packages contain hidden code that is effectively run during importing or using the library, and downloads second stage code. Then, a process running in...

Malicious code in sme-rko-finance-front-operations-special-payments (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a7bfbc55631ce8b054b20444bf1e335244c998fcf00d1709f951b1afa4cb242 On require of the package, index.js loads support.js which downloads a platform-specific binary from string-concatenated cloudflare workers.dev...

Malicious code in sme-rko-finance-front-payments-allowed-tariffs-filter (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6d957fec8c08e1dcadbcd6e4b6933a1c1482356e79adbfe1f6ceb6d64a68855f On require of the package, bootstrap.js selects a platform-specific path from a hardcoded map, downloads an opaque binary from one of three Cloudflar...

Malicious code in sme-rko-finance-front-payments-classic-payment-actions-operations-repeat-models (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b691054dd402370143740f95ea751e6f5c7caa51753e91ccc11fadabca90e637 On require, index.js loads bridge.js which selects a platform-specific asset path linuxx64, linuxarm64, darwin, win32, downloads bytes from a rotatin...

Malicious code in @nestjs-passport/jwt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0d3060c9289c475e223c1c00bc21a0f59f8aa5b18e31bfaee6e4d923eab0042f Package published under the @nestjs-passport scope, which resembles the official @nestjs/jwt and @nestjs/passport packages. The sole entrypoint files...

Malicious code in dolyame-ui-inputtag (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b5f7fb3babc69bc0dbb80ecfe5c523d9aee1bbf2476331424ea57290985d0bf8 On require of the package's main entry, index.js loads init.js which downloads a platform-specific executable from hardcoded oob-worker..workers.dev...

MAL-2026-13599 Malicious code in dolyame-ui-sortablelist (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c6a49e10172c9781161b964655fc6720e845ddf2049f0cfdbb39464946dbcd7 On require the package fetches a platform-specific executable from obfuscated Cloudflare Workers hosts oob-worker.cf100..3-.workers.dev, host strings...

Malicious code in dolyame-ui-inputrange (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aae096235cf72db7f2e9908e53fa5a6e7c87718539a9e3452e0e34f7345ca80f On require of dolyame-ui-inputrange, init.js reconstructs a rotating list of Cloudflare Workers hostnames via split-string joins e.g...

Malicious code in bnpl-blocks-atom-bnpl-checkbox (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3db8a9fa19a0529093120a57fddb0821928cd0050c4f9062956eb73a80fc17b0 On require of the package main, polyfill.js runs an async bootstrap that reconstructs network destinations from string-split fragments...

Malicious code in dolyame-ui-draghoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b2e12132d37505525293870b3a824831321d42adf75758e949b30139a002955 On require, index.js loads loader.js which selects a platform-specific asset path, fetches an unsigned binary over HTTPS from hostnames reassembled a...

MAL-2026-13567 Malicious code in dolyame-ui-draghoc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9b2e12132d37505525293870b3a824831321d42adf75758e949b30139a002955 On require, index.js loads loader.js which selects a platform-specific asset path, fetches an unsigned binary over HTTPS from hostnames reassembled a...

MAL-2026-13518 Malicious code in postcss-theme-provider (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d8d6afcada49b5397e1b4d6a41d4ec0b31903593e65219c919e0d310d3941a40 packages/core/src/index.ts and plugin.ts compiled into dist/index.cjs referenced by main contain a top-level async IIFE that executes on require of t...

Malicious code in speed-hashes (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 120e6126065bccc254b925a6913422c0cbdd201054437820369c2726fd4a2871 setup.py defines a custom install command NativeInstall that runs on pip install. After the normal install step, a base64 literal COMPATPAYLOAD is...

CVE-2026-54218

Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various files using only obfuscation. Any user with access to the server’s file system, or who can otherwise extract files from the server see...