6701 matches found
MAL-2025-192373 Malicious code in @notrainers/nobtrainer-sdk (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7f897e383035341f83bc0c7357ec775c42dcf5f88689994882325daf4c5c6730 The package @notrainers/nobtrainer-sdk was found to contain malicious code. Source: ghsa-malware...
CISA Reports PRC Hackers Using BRICKSTORM for Long-Term Access in U.S. Systems
The U.S. Cybersecurity and Infrastructure Security Agency CISA on Thursday released details of a backdoor named BRICKSTORM that has been put to use by state-sponsored threat actors from the People's Republic of China PRC to maintain long-term persistence on compromised systems. "BRICKSTORM is a...
Malicious code in chai-as-deployed (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7ebc44576073489ddc650d352e43bee3aa036bcdc2914887eb9c36be2780e09b The package chai-as-deployed was found to contain malicious code. Source: ghsa-malware 117c632d121fc31a4f589c4d76730535c6d5b576ae6e3addab756be448c13b...
MAL-2025-192309 Malicious code in node-dpapi1 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a892f37c5be6dceac9cda541ce52d7dc4456d98acbfaa7d2a1e530d181567e29 The package node-dpapi1 was found to contain malicious code. Source: ghsa-malware 96a0f4f04fbe21b39cfa4fe8473fc5394bcecce0f814fcba5f89d6f6217e523d An...
PRC State-Sponsored Actors Use BRICKSTORM Malware Across Public Sector and Information Technology Systems
The Cybersecurity and Infrastructure Security Agency CISA is aware of ongoing intrusions by People’s Republic of China PRC state-sponsored cyber actors using BRICKSTORM malware for long-term persistence on victim systems. BRICKSTORM is a sophisticated backdoor for VMware vSphere1,2 and Windows...
Malicious code in elf-stats-lanternlit-snowman-834 (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4a5ba8a53d8eaf81612c735ecd48fa5c485199e190ba2e4047f1160d5ad1d9dc The package elf-stats-lanternlit-snowman-834 was found to contain malicious code. Source: ghsa-malware...
Malicious code in email-validated (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 16af72446800f2251ecdda400ad30c23637f628d1487ae5c911bb4283e3fe10c The package email-validated was found to contain malicious code. Source: ghsa-malware 9f2a0d9794c8d949cc051fe3c306af63ddb55b6848d0607ef1f5d332585a2fc...
Malicious code in buffer-envjs (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 328f0f326f30ba6e46eee18a532f81cdd6afdbd656e79c16ec2158af7f924c8f The package buffer-envjs was found to contain malicious code. Source: ghsa-malware 7dc4f4a51201db42dd81059708300e05eabba51b1ab48793c8f37d582fd24d93 A...
Periodic Directory Security Audit 1.0
This code enables persistence via the /etc/periodic directory similarly to recent metasploit modules that perform the same function. This is a variant written in PHP...
Malicious code in pulsecord (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 025d4e33a2037fb9ad36cb4b08b122e4439bb4932b73ac6c6f403609e7e1c09e This package is prepared for silent execution of a malicious executable, with disabling AV protection. While there is no link to the malicious binary inside, t...
MAL-2025-191830 Malicious code in pulsecord (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 025d4e33a2037fb9ad36cb4b08b122e4439bb4932b73ac6c6f403609e7e1c09e This package is prepared for silent execution of a malicious executable, with disabling AV protection. While there is no link to the malicious binary inside, t...
Directory Traversal
github.com/argoproj/argo-workflows is vulnerable to Directory Traversal. The vulnerability is due to improper validation of archive entry paths during artifact extraction, which allows an attacker to craft malicious archive files that write arbitrary files outside the intended extraction director...
Malicious code in tensorfi-secure-hash (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 93a1f3633d2738b3112eae340090cc5ca67f6847ed89ade9de6c8448b591c20b The package tensorfi-secure-hash was found to contain malicious code. Source: ghsa-malware...
MAL-2025-191536 Malicious code in @wxi-dev/serverless-tsc-config (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2044be2f48924b1fbab5515839d24440bd12b3d7df98de95a6b0881665ab3f94 The package @wxi-dev/serverless-tsc-config was found to contain malicious code. Source: ghsa-malware...
MAL-2025-191537 Malicious code in cyber-fca (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b577f3dcb8f7ebe36e69f65a8b605a23ff2dbdb7d896e78bc20f1880331a238c The package cyber-fca was found to contain malicious code. Source: ghsa-malware c7c387785610633bef06443bfd2ecd4a274d3d1265e22822b04579fae216ba2c Any...
Malicious code in cyber-fca (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b577f3dcb8f7ebe36e69f65a8b605a23ff2dbdb7d896e78bc20f1880331a238c The package cyber-fca was found to contain malicious code. Source: ghsa-malware c7c387785610633bef06443bfd2ecd4a274d3d1265e22822b04579fae216ba2c Any...
ASB-A-352024705
In onSomePackagesChanged of VoiceInteractionManagerService.java, there is a possible way for a third party application's component name to persist even after uninstalling due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges...
MAL-2025-191798 Malicious code in multithreadedexecution (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3248950b032e1381ddc79d43dfdba8fb6dccce4b1afafd5825e560d793b3bd09 Once run, package downloads and installs an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
Malicious code in multithreadedexecution (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 3248950b032e1381ddc79d43dfdba8fb6dccce4b1afafd5825e560d793b3bd09 Once run, package downloads and installs an infostealer --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign:...
