Malicious code in @mistralai/mistralai-gcp (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3dcfd7fec176cc54232767b454429a7b3e0106aebbb16f2e9bdacc57e8a20ff9 The package @mistralai/mistralai-gcp was found to contain malicious code. Source: ghsa-malware...

MAL-2026-2991 Malicious code in pgserve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector c48b943e993f7a62fe43ad9c5412ad1750fd3d5a8cd5214988b16caf78f4a06d The package pgserve was found to contain malicious code. Source: ghsa-malware 3eb07d42183ec3a63a62edc4353d8dbaa85afd8c1830fa5b6ef2617fb5a2b3e0 Any...

Malicious code in @b2b-portal/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a28e67919e3dfef2a8a434caec109791355b6f43d434d22bd9515f348a692c5e The package @b2b-portal/core was found to contain malicious code. Source: ghsa-malware 7a10dd57d5e27c26f36c8207faa6449838827281be33c9ecc99e025cfdea19...

Malicious code in typescript-react-query (npm)

The package 'typescript-react-query' is part of the PhantomRaven supply chain attack campaign Wave 2. It uses a Remote Dynamic Dependency RDD technique: the published package appears benign but includes a URL-based dependency in package.json pointing to an attacker-controlled C2 server...

Malicious code in pycolorom (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 6babcee81c12759b66be4c0a8ba33c3f0272b052a47fda31227f4a6087ba8e5b The package, distinguished as a speed testing or typosquatted Telegram library, contains a Telegram bot to perform remote control of the computer --- Category:...

MAL-2025-192585 Malicious code in betterjsloggin (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector de0ccde11f9011e9a5b0f96421a9d3088ed2f2604afdfc4f24d3753497729a06 The package betterjsloggin was found to contain malicious code. Source: ghsa-malware 9474602fb42d55f04ad6c25502fa73adc2f3313def621342428ea0b2f13c3d28...

Malicious code in @diotoborg/corporis-repellat-dicta (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f3229e2ebcd959f3293a3029d72ff7cb7f47ff3432f84ec65dd90faf2300ef71 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2023-49716

In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer...

CVE-2023-46687

In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer...

Cross site request forgery (csrf)

In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer...

CVE-2023-49716 Emerson Rosemount GC370XA, GC700XA, GC1500XA Command Injection

In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer...

pyGPOAbuse - Partial Python Implementation Of SharpGPOAbuse

Python partial implementation of SharpGPOAbuse by@pkb1s This tool can be used when a controlled account can modify an existing GPO that applies to one or more users & computers. It will create an immediate scheduled task as SYSTEM on the remote computer for computer GPO, or as logged in user for...

Malicious code in recurrence-formatter (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 970492e695237c754d7801c30cdab26ae4402dd14fe49a15fbe5a009641021e8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in cms-serviceclients (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6378607eb6158e7d672a2316b410a0e35babc9eb618b207d8dee2c25d1212f7e Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

AnyDesk 代码问题漏洞

AnyDesk is a remote desktop connection software from AnyDesk Germany. A security vulnerability exists in AnyDesk versions prior to 6.2.6 and 6.3.x prior to 6.3.5, which allows an attacker to upload files to the victim's computer without authorization when the attacker is connected to the same...

Malicious code in simontok (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware caa06374b63fc26ac5950bd03891861724e6b84eafeeea9a17277df2116b3392 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in electron-test-app (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 75b506fc33ed414469cf76d4db3886a4df9ab59986b5f8a52180cc3d49df9077 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

ScheduleRunner - A C# Tool With More Flexibility To Customize Scheduled Task For Both Persistence And Lateral Movement In Red Team Operation

Scheduled task is one of the most popular attack technique in the past decade and now it is still commonly used by hackers/red teamers for persistence and lateral movement. A number of C tools were already developed to simulate the attack using scheduled task. I have been playing around with some...

IDrive 安全漏洞

Idrive IDrive is a suite of cloud backup and cloud storage service solutions from IDrive USA. A security vulnerability exists in iDrive RemotePC versions prior to 4.0.1, which can be exploited by an unauthenticated attacker to disconnect a valid user session by connecting to a temporary port...

Command injection

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to b...