Malicious code in express-middle (npm)

Source: amazon-inspector 91c0275a4e65fc4ed9930cb89002f2c4ebc50163b292f552703c4ea6a9940567 package.json declares postinstall: node index.js, which fires automatically on npm install. index.js is a heavily obfuscated bundle obfuscator.io-style RC4-decoded 344-entry string array with control-flow...

Malicious code in exoplanet-string-bulma-tardigrade (npm)

Source: amazon-inspector 3db6d30965032b31e8676816820d7bbeb491cca49937b3702c7436d896a3b8df This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in exec-concurrently-run-script-pm2 (npm)

The package exec-concurrently-run-script-pm2 was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ethereum-sign-utils (npm)

Source: amazon-inspector a6f2998ee6903e6a20b55e371b8b074fb130d3e4c6f6d489999fd61f7e536673 On npm install, the package's postinstall script node postinstall.js, declared in package.json scripts.postinstall reads installer-side secret files including.env variants, /.npmrc, /.aws/credentials,...

Malicious code in eslint-config-sirius-run-script-sublimation (npm)

Source: amazon-inspector 78a80afbce79edd35b6742c49c7370920da3f1a0237ff091da1314fd7828be10 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in entropyeasybots (npm)

Source: amazon-inspector 82e7d0cd2ef4870fdc4484c815737ade78e04bdac4843df02f5cf876cfa3dbaa index.js decodes a base64-obfuscated IP 85.137.253.124 and connects a spawned /bin/sh subprocess's stdio to a TCP socket at 85.137.253.124:1111, granting remote shell access on the installer's host...

Malicious code in enif-xanthus-spinner-run-script (npm)

Source: amazon-inspector 9db2a2a6b38813741e236952bf69ea1a2c3a40717e72f42046ef0b57d3e2ded8 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in encrypt-meta-authenticate-log-string (npm)

Source: amazon-inspector d7b652ac77988fd5095d31173051f104a9282bb6428032f99261ebbee04f6289 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js, autopublish.js, autopublish2.js, autopublish3.js designed ...

Malicious code in elephant-array-utils (npm)

Source: amazon-inspector d2cfcddc59bba26e90415bf89488d4a814e5c1db07091da5e46b07f7727e49bb index.js is a heavily obfuscated obfuscator.io: rotated string array + RC4 decoder, control-flow flattening, hex literals top-level IIFE with no functionality matching the advertised 'array utils' purpose. O...

Malicious code in electron-wix-msi-local (npm)

This package runs commands in a pre-install script that exfils sensitive data to a attacker-controlled domain. --- Credit: OpenSSF source...

CISA Flags Exploited Cisco, Citrix, Fortinet Flaws, Sets Sept. 12 Federal Patch Deadline

The U.S. Cybersecurity and Infrastructure Security Agency CISA on Wednesday added three flaws, each impacting Cisco, Citrix, and Fortinet, to its Known Exploited Vulnerabilities KEV catalog, requiring Federal Civilian Executive Branch FCEB agencies to apply the patches by September 12, 2026. The...

CVE-2015-3224

CVE-2015-3224 Exploit - Rails Web Console RCE A JavaScript implementation Node.js of the exploit for CVE-2015-3224. This tool targets Ruby on Rails applications running vulnerable versions of the web-console gem, allowing unauthenticated Remote Code Execution RCE. About the Vulnerability...

oss-oopssec-store v2.20.0

OSS - OopsSec Store Security training for the apps you actually ship. 36 challenges across web, API, authentication, business logic, cryptography, supply chain, AI agents and MCP. Break a deliberately vulnerable e-commerce app built on Next.js, React, TypeScript and Prisma. Find the bugs. Exploit...

smartermail-cve-scanner

SmarterMail CVE-2025-52691 扫描器 SmarterMail 中的 CVSS 10.0 RCE 漏洞。您的邮件服务器是否易受攻击？ 用于检测 CVE-2025-52691 的快速、精准扫描器——这是一个严重的未授权任意文件上传漏洞，可在 SmarterMail 服务器上实现远程代码执行。 关于 CVE-2025-52691 CVE-2025-52691 是 SmarterMail 中的一个最高严重级别（CVSS 10.0）漏洞，允许通过任意文件上传实现未授权远程代码执行。 关键信息： 受影响版本： SmarterMail Build 9406 及更早版本 攻击向量...

OSEC-2026-19 JOSE: missing RSA signature verification

The opam package "jose" does not validate any RSA signature. It checks the encoding being PKCS1, but does not verify with the public key. Reproduction With jose 0.10.0, the code below signs two tokens with the same key and glues one's payload onto the other's signature: OCaml let =...

OSEC-2026-18 Marshal integer overflow leads to out-of-heap read

An integer overflow in the length-validation logic of OCaml's Marshal deserializer allows a crafted serialized object to bypass all bounds checks added by the CVE-2026-28364 fix, producing heap out-of-bounds reads from Marshal.frombytes / Marshal.fromstring and the C API camlinputvaluefromblock...

CVE-2025-50944

CVE-2025-50944 Improper Certificate Chain Validation in EagleEyes Lite Android Application 1. Overview Name : EagleEyesLite Version : 2.0.0 Vendor : AVTECH CWE : CWE-295: Improper Certificate Validation CVSS : 8.8 HIGH Vector String : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H 2. Summary...

CVE-2025-66478-kinda-waf

kinda-waf Protector WAF temporal y sencillo dirigido a una secuencia específica de payload. ¡Ayudemos a que los sitios web se mantengan seguros hasta que estén debidamente parcheados! Propósito Proteger de CVE-2025-66478 detectando y bloqueando solicitudes que contengan firmas de payload...

CVE-2025-12720

g-FFL Cockpit 'POST', 36: 'callback' = CLASS, 'handleenqueueonly', 37: 'permissioncallback' = fn = self::fflcockpitisallowedself::$fflckey, 38: ; fflcockpitisallowed 函数使用一个硬编码的 IP 地址（base64：My4yMTIuMTg1LjE4Nw==，解码后：3.212.185.187），该地址在插件源代码中可见。 来自 class-sync-endpoint.php 的漏洞代码片段： root@kitploit: 11...

krle

REACT2SHELL CVE-2025-55182 React2Shell CVE-2025-55182 は、Server Actions を利用する Next.js アプリケーションに影響を与える重大なリモートコード実行（RCE）脆弱性チェーンです。この脆弱性は、プロトタイプ汚染と Server Actions を組み合わせて、認証なしでサーバー上で任意のコードを実行するものです。 このリポジトリは、React2Shell のペイロードとバイパス方法を共有するためのものです。PRやコントリビューションはいつでも歓迎します！ リソース 以下は役立つ追加リソースです： Assetnote...