Malicious code in loki-release (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75940c2d0ed836d2725549e9704eaefe1d989aa5349c7b27fdf2556be16e32a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in webvieweventtest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 09cd6e6230cc73bbb40ce4f9ccd122eabff367f8c81c3586c848476a8e6900fd Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in appcenter-sampleapp-react-native (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8015d357cb8b89fe98c7076abd8ca3ea3146d43990de4f2410c5e2627a2fe970 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @stride-mfe/wmc (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 77cc9defe144c1f3b98ce1ea8f91ca33aaf789c8ed02f2ee137861782c89f711 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cas-base (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69eb341218878aebdec66eb5a44391314921fe3c7fb387021d0684bbb91913b3 The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigge...

MAL-2025-193014 Malicious code in cas-base (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 69eb341218878aebdec66eb5a44391314921fe3c7fb387021d0684bbb91913b3 The package contains code to install remotely stored malware and ensure its persistence. The code is not triggered automatically; it requires a separate trigge...

Innovative Tunnelling and Forensic Tool Abuse: IR Tales from the Field

Rapid7 Incident Response consultants Willow Shipperley and Noah Hemker contributed analysis and insight to this blog. Executive summary Rapid7’s Incident Response IR team was engaged to investigate an incident involving an attempted Cobalt Strike execution. The investigation uncovered twists and...

Malicious code in fxa-auth-server (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 001dcafa5fa85d6d5358a1a79909f92615e17cae27329f2b1fea9c1cc51d41ca Any computer that has this package installed or running should be considered...

Malicious code in comment-on-task-github-action (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b72236d210ad08858f047149a80c8690160ba7d9e24089047dd82efcc25db90c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tyrtle (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a6e13a7780a46e82cf53e4515084323c593dd81279f30c4010258429cb0beaba Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jquery-zoomer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware acbf4e3c76ef6d0551f9bcc3420755fcabf7d985871c714a3ea7cfdcb43a6d94 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in dt-internal-linter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a5c720ae7505ae2c4d74c0ce8cea7fdb4961f4de5c0fddc8c485c7b66c87097d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jwoiesk11 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8272ab239b8e1ffc477bd4ffb90538ddeb7d1cd11f6bba6b8ee8a396aeafdb61 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in ai-guide (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 344da047769642e93f7d727b850c547fe9be2272daef99e44ef3f7c9b0f4bc77 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in elbol (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0b99a8bf6adb423e7d8328ec1e179ba48ee34d663ab80a55b1c27d156605413f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in solsafe (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 8c0e330c03bcbf5c40a3477fd4fa0029e71ee952bcbdc57bbaf89d39cbec85ac Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @instant-postgres/neon (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 5998172caafd763bd9d8fc92acc7e18e96f4a14c19f5871e16257eaff6547366 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in restpilot (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ea95902e229e600fed776ab58f9216738dd1db24c03890b9902da283f3413623 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in n8n-nodes-simple-alert (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 135883bb204e44d7cd636264bc588abe6432b574585bb5c71862c646e233997b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in pupeteer-cluster-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1fe95354a3e77909ce12723e8b6920602c16294ebe131716c947de18ed799d18 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...