Malicious code in ts-jito (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cf71580a117fc1eb648238b8dbf5e2919978bc9bb694df76ef5b844542839736 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in working_tests (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 49c21a63c0a80ed6817e5b19617e29f869d463d77843ef462ec7f9f177abe0aa Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @rxnt/ambientiqstandaloneapi-client (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d4084f155a192c466c14a5f1b90a954c7ce9be74b5071b04730d44510a364a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

📄 Init OpenRC Persistence

This Metasploit module will create a service on the box via OpenRC, and mark it for auto-restart. We need enough access to write service files and potentially restart services. Verified against alpine 3.21.2. This module requires Metasploit: https://metasploit.com/download Current source:...

Malicious code in @nstudio/web-angular (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 19e2b2f064a728f3b2e6564cef5f7c00fc9a166f8a2e97291041de79f3b572c2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @nstudio/web (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2c10ca009d851af8a5cd991038674696dcba73033bd87678ae2187dde082e8e5 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47173 Malicious code in autopush-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 59357a0c8a37bd710b781f7f8bf8c109d97d69a67750b2103527085c9377bc42 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47193 Malicious code in newrelic-infra-operator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0d13f7915d1227dc54cc2f1481a151b94b159d4ec2941d00db71133b636b5ed1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in basic-pump-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc10b9f2bba8789f982dedfa26ff72ba0c4149b11d522b1d60523fac65c58419 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47182 Malicious code in internallib_v320 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 204ed31fa77ee7b2a41f972ca8834f0cb6e4912b1155723e364227e15df8ce6a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-47183 Malicious code in internallib_v819 (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d31ba534b4f8ffc55121d6aa3784d30b023a96d6b88430ea1445a9b838068562 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in eth-node-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43e3bae1d6be9bca527622368d2a291d97b40692ce8996525eefb78917c7e0de Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

update-motd.d Persistence

This module will add a script in /etc/update-motd.d/ in order to persist a payload. The payload will be executed with root privileges everytime a user logs in. Root privileges are likely required to write to /etc/update-motd.d/. Verified on Ubuntu 22.04 Module Options msf use...

Malicious code in @cryptochords/shared (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0557b94cb12763b7d0b2bc1fbfea247c656476c068c2bf2161f8fa35ce3254cb Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

at(1) Persistence

This module executes a metasploit payload utilizing at1 to execute jobs at a specific time. It should work out of the box with any UNIX-like operating system with atd running. Verified on Kali linux and OSX 13.7.4 Module Options msf use exploit/multi/persistence/at msf exploitat show targets...

CVE-2025-10213

DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a dxtn.dll file of their choice in the 'C:\Users\AppData\Local\Microsoft\WindowsApps' directory, which could lead to arbitrary...

CVE-2025-40979

DLL search order hijacking vulnerability in the wave.exe executable for Windows 11, version 1.27.8. Exploitation of this vulnerability could allow attackers with local access to execute arbitrary code by placing an arbitrary file in the 'C:\Users\AppData\Local\Temp' directory, which could lead to...

CVE-2025-10214

DLL search path hijacking vulnerability in the UPDF.exe executable for Windows version 1.8.5.0 allows attackers with local access to execute arbitrary code by placing a FREngine.dll file of their choice in the 'C:\Users\AppData\Local\UPDF\FREngine\Bin64' directory, which could lead to arbitrary...

Malicious code in graphchain (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 0f74a555cfba6dedc51a937d8cf8c843437538581dea703284d1e872317263f3 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AsyncRAT Exploits ConnectWise ScreenConnect to Steal Credentials and Crypto

Cybersecurity researchers have disclosed details of a new campaign that leverages ConnectWise ScreenConnect, a legitimate Remote Monitoring and Management RMM software, to deliver a fleshless loader that drops a remote access trojan RAT called AsyncRAT to steal sensitive data from compromised...