BeatRev

BeatRev 版本 2 免责声明/责任 以下工作是概念验证，旨在使恶意软件能够针对特定受害者进行“密钥绑定”，从而挫败恶意软件分析人员的工作。 我不对本项目中所包含的任何想法或代码的恶意使用承担任何责任。我提供此研究是为了进一步教育信息安全专业人士，并为恶意软件分析师、逆向工程师和蓝队成员提供额外的培训/思考素材。 TLDR 恶意软件首次在受害者机器上运行时，会使用该受害者的环境数据对实际载荷（一个 RDLL）进行 AES 加密。每次后续运行恶意软件时，它会收集相同的环境信息，对存储在恶意软件内字节数组中的载荷进行 AES...

WifiPassword-Stealer

WifiPassword-Stealer 从目标计算机获取所有已注册的WiFi密码。 安装 （如果你使用的是Python文件） root@kitploit: pip install smtplib pip install subprocess pip install glob 使用方法 •使用临时邮箱在"https://mailtrap.io/"上创建一个账户。 •在"main.py"中设置你自己的SMTP用户名和SMTP密码。 •使用此命令创建EXE文件。 root@kitploit: python setup.py build 将"build"文件夹发送给你的目标。...

Keylogger

输入到邮件 获取键盘、鼠标、屏幕截图、麦克风输入并发送到你的邮箱。 该项目的目的是测试信息系统的安全性。 安装 你无需任何操作即可安装，只需运行脚本 使用 •在"https://mailtrap.io/"上使用临时邮箱创建一个账户。 •在"keylogger.py"中设置你自己的SMTP用户名和SMTP密码。 •pip install -r requirements.txt •python3 keylogger.py •每10秒，你将从目标计算机获取数据。 •如果目标用户发现代码并为了获取你的邮箱和密码而打开文件，程序将自行删除。 抗病毒测试...

MAL-2026-10535 Malicious code in my-empty-package (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 914ffc98ce1f6553e4f9655208318800d0d22663842eb4c9a3d0d51d4f143bdd package.json declares postinstall: node index.js. On npm install, index.js branches on os.platform and executes platform-specific shell commands:...

Malicious code in permcarmserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...

MAL-2026-10488 Malicious code in permcarmserver (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4e70168ba32f543c08a0c98b81e648d09e9793bcc533a34c2f0ce9ca7a14536e On require, index.js spawns a worker that uses koffi FFI to load a file named index.html and invoke its exported vserverstart. Despite the extension,...

MAL-2026-10442 Malicious code in @oliviamcdaniel12/safer-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f Package impersonates the popular safer-buffer module. On require, safer.js reads a PID from Porting-Buffer.md and, if that process is not alive, spaw...

Malicious code in @oliviamcdaniel12/safer-buffer (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 55129478b44191f3a4bb3308036567d5e2eb1a73084511b424917b6b5f7bf50f Package impersonates the popular safer-buffer module. On require, safer.js reads a PID from Porting-Buffer.md and, if that process is not alive, spaw...

MAL-2026-6357 Malicious code in theme-color-picker (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f7a4ba7e8664b9e1d99c4018963a4731d591653d7f2a9b879ba090e7a7f6e7bd Although the package presents itself as a 'theme color picker', package.json identifies the publisher as analysis-chart.io with repository...

Embedded Malicious Code

Overview Affected versions of this package are vulnerable to Embedded Malicious Code that conceals a remote code execution backdoor and an advanced credential stealer. A malicious actor exploited remapped historical tags to commit malicious commits, retroactively compromising over 700 versions of...

GHSA-GFHQ-7499-F3F2 TSPortal: Any user can forge self-deletion requests for any account

Summary Conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. Details Creating a DPA report about another user and leaving the evidence field empty causes that report to look like the reported user self-requested deletion of their data. Ingenuine repo...

EUVD-2026-10067

TSPortal: Any user can forge self-deletion requests for any account...

TSPortal: Any user can forge self-deletion requests for any account

Summary Conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. Details Creating a DPA report about another user and leaving the evidence field empty causes that report to look like the reported user self-requested deletion of their data. Ingenuine repo...

CVE-2026-29788

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been...

CVE-2026-29788

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been...

CVE-2026-29788 TSPortal: Anyone can forge self-deletion requests of any user

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been...

CVE-2026-29788 TSPortal: Anyone can forge self-deletion requests of any user

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been...

CVE-2026-29788

The CVE affects TSPortal (WikiTide Foundation) prior to version 30, where converting empty strings to null allowed disguising DPA reports as self-deletion reports. Root cause is the faulty normalization of empty fields in the report handling flow. Impact described includes confidentiality/availab...

CVE-2026-29788 TSPortal: Anyone can forge self-deletion requests of any user

TSPortal is the WikiTide Foundation’s in-house platform used by the Trust and Safety team to manage reports, investigations, appeals, and transparency work. Prior to version 30, conversion of empty strings to null allows disguising DPA reports as genuine self-deletion reports. This issue has been...

TSPortal 安全漏洞

TSPortal is a team management platform developed by Miraheze. Previous versions of TSPortal had security vulnerabilities; these vulnerabilities stemmed from the conversion of empty strings to null values, which could lead to data protection reports being disguised as genuine self-deletion reports...