Malicious code in requestz-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f6eab2fca0656f140282d442e79f3edae4b6879f6e798147e1fe56f9aa34eda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2702 Malicious code in requests-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2f69e675db1c52596e208921e91e76489607213dc7f4f3c5ce9f9a824b02778e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-2703 Malicious code in requestz-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 4f6eab2fca0656f140282d442e79f3edae4b6879f6e798147e1fe56f9aa34eda Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

The evolution of the Kuiper ransomware

Kuiper Ransomware’s Evolution By Max Kersten · January 17, 2024 The Golang-based Kuiper ransomware is presented as an opportunity for other criminals to make money by ransoming one or more targets. Additionally, RobinHood, the actor behind Kuiper, states that help with operations can be provided...

Beware malware posing as beta versions of legitimate apps, warns FBI

The FBI has issued a warning that cybercriminals are embedding malicious code in mobile beta-testing apps in attempts to defraud potential victims. The victims are typically contacted on dating sites and social media, and in some cases they are promised incentives such as large financial payouts...

Attackers Flood NPM Repository with Over 15,000 Spam Packages Containing Phishing Links

In what's a continuing assault on the open source ecosystem, over 15,000 spam packages have flooded the npm repository in an attempt to distribute phishing links. "The packages were created using automated processes, with project descriptions and auto-generated names that closely resembled one...

Mimalloc Can Allocate Memory with Bad Alignment

This crate depended on a promise regarding alignments made by the author of the mimalloc allocator to avoid using aligned allocation functions where possible for performance reasons. Since then, the mimalloc allocator's logic changed, making it break this promise. This caused this crate to return...

The MSP playbook on deciphering tech promises and shaping security culture

The in-person cybersecurity conference has returned. More than two years after Covid-19 pushed nearly every in-person event online, cybersecurity has returned to the exhibition hall. In San Francisco earlier this year, thousands of cybersecurity professionals walked the halls of Moscone Center at...

A Retrospective on the 2015 Ashley Madison Breach

Its been seven years since the online cheating site AshleyMadison.com was hacked and highly sensitive data about its users posted online. The leak led to the public shaming and extortion of many Ashley Madison users, and to at least two suicides. To date, little is publicly known about the...

Malicious code in noblox.js-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef88a053d29099e2f11a2382e0f0c51f729ec1e0574088753c633ed9a9e8f722 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-4872 Malicious code in noblox.js-promises (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ef88a053d29099e2f11a2382e0f0c51f729ec1e0574088753c633ed9a9e8f722 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Twitter fined $150M after using 2FA phone numbers for marketing

The Federal Trade Commission FTC and the Department of Justice DOJ have ordered Twitter to pay a $150M penalty for using users account security data deceptively. The deception violates an FTC order from 2011, that bars Twitter from "misleading consumers about the extent to which it protects the...

Time based username enumeration

Back in the day, it used to be easy to enumerate email addresses from forgotten password forms. Differences in the response made it easy to check if accounts existed. After that, you could brute force the password if there weren’t lockouts in place, or if there were, you could lockout a lot of us...

CVE-2021-41167

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they...

CVE-2021-41167

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they...

CVE-2021-41167 Unlimited requests in modern-async

modern-async is an open source JavaScript tooling library for asynchronous operations using async/await and promises. In affected versions a bug affecting two of the functions in this library: forEachSeries and forEachLimit. They should limit the concurrency of some actions but, in practice, they...

CVE-2021-41167

CVE-2021-41167 concerns the open-source library modern-async, where the functions forEachSeries and forEachLimit fail to enforce concurrency limits as intended. Multiple connected documents confirm this behavior and note the issue affects the library’s ability to limit concurrent actions, potenti...

What is scareware?

Scareware is a type of rogue program which has been around for many years, arguably dating back to 1990. It can be installed without permission, or via deception and false promises. Scareware is primarily used to panic or worry someone into performing a task they otherwise wouldn’t have done. The...

Cloud Cryptomining Swindle in Google Play Rakes in Cash

Bogus cryptomining apps for Android available for download on Google Play are estimated to have scammed more than 93,400 victims to date, researchers said, stealing at least $350,000. According to Lookout, the apps – categorized into “BitScam” and “CloudScam” versions – advertise themselves as...

In JS functions, the 'last' return wins

In JavaScript functions, which return wins? function test return 'one'; return 'two'; return 'three'; You might say, "well it's the first one", but I'm going to try and convince you it's the last one. Don't worry, the function above definitely returns 'one', but in this case the first return...