Malicious Package

Overview readmecolorama is a malicious package. This package contains payloads with Windows and Linux variants that access and exfiltrate sensitive configuration information, establish remote control / remote access for the attacker, establish persistence and “command and control” C2 mechanisms...

Malicious code in @sasmeee/igdl (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 50d2d88fbf066d2cf61e4e0c78589fb68f9b35f261c3ee3bf1c852cb431272ed Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in haji-fb-toolkit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c179e308c7e88b7d392065ed54495057f295048ce909d24f2345d5a28300d568 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in express-api-sync (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware efac302be698778eb5fe49cde2fadcf3d675910622eaf3387754f96e332f87f9 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in plugin-svg-icons (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 824299b29c64a19455bcdc235b9c2726b1ae00b364f8a549bb972a1be842eb43 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in modsys-cloud (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3ec4d746dad0e8ec6c9a218ee82eee9df40c214420c3bae1974826bee6772a63 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in viryy-nexa (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 83da7b12f8cd7a828569d2936d55759bc96ad48760ba8ea0124dcf612721e671 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

📄 Udev Persistence

This Metasploit module will add a script in /lib/udev/rules.d/ in order to execute a payload written on disk. It will be executed with root privileges every time a network interface other than l0 comes up. This module requires Metasploit: https://metasploit.com/download Current source:...

Access Control Bypass

Overview Affected versions of this package are vulnerable to Access Control Bypass due to improper validation of user permissions. An attacker can bypass security restrictions and perform unauthorized actions by exploiting this vulnerability. Remediation Upgrade...

Malicious code in remote-actions (npm)

The package communicates with a domain associated with malicious activity. --- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 602ccb0c9280efaed9bc494cf89db45c8fd4d77619a8b621c339d44dc6479bf5 Any computer that has this package installed or running should be considered...

Malicious code in blipkitgit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6e899e9940707fc06d8dce8080f1ea4e59dbdfbb122526755ce4006c4e226d92 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-48955

Para is a multitenant backend server/framework for object persistence and retrieval. A vulnerability that exists in versions prior to 1.50.8 exposes both access and secret keys in logs without redaction. These credentials are later reused in variable assignments for persistence but do not require...

Malicious code in log-trap-catch (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9dc12c22fb18702b22d35fa127f4f43058dc50f65393e6bbb1d666b48bb7d905 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

SQL Injection

Overview Affected versions of this package are vulnerable to SQL Injection through the role parameter within the API endpoint /api/artist. An attacker can execute arbitrary SQL commands and potentially access or alter sensitive data by injecting malicious SQL queries into the input field...

New PumaBot Botnet Targets Linux IoT Devices to Steal SSH Credentials and Mine Crypto

Embedded Linux-based Internet of Things IoT devices have become the target of a new botnet dubbed PumaBot. Written in Go, the botnet is designed to conduct brute-force attacks against SSH instances to expand in size and scale and deliver additional malware to the infected hosts. "Rather than...

Malicious code in midd-js (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 9dd0235b84c32b991facdc8454fcad039a9ad0d52cdc8f5d4a6c3504657c7fa6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in jwt-audit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53e6fefcdc9ad0aef91f34767bdce289240d2c62fe34698883f251d54360dc69 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in loglinea (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 799f4899d8d2f6f45f1548fbb2b601f27c8f078d7b0db92af859a074f8dc3971 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in newquest (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware a849e1ffa2a1ed558e656470b768587636a31790355a8266058e4d9f0edef839 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in super-randomizer (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 46a7beb67969c60a902fa65a47d6bd880c7de7d3d731f2cc6362efeddf2849ce Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...