Hackers Hijack Five OVHcloud CLI Releases to Distribute Secret-Stealing Malware

An attacker used a contributor's GitHub account to replace the download archives on five existing releases of OVHcloud's command-line tool on Monday, October 19. The account had been hijacked, and the new files were a build designed to steal secrets stored on the disk of any machine that runs it,...

Malicious code in discord-spammer-webhooks (npm)

Source: checkmarx 992e658db3addbbf4402e9f8bfb5c3a8af81b96c87e70863df390190f52de66b EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmver (PyPI)

Source: checkmarx 57a72e03d4d746920e78e54fbb3a4185a85287c730f77f2e599527b9237461fb EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmvm (PyPI)

Source: checkmarx 0d42dff46abc429b6a9473a8171731b0e510c358da63fd18935282b6c3a7aeb6 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmtool (PyPI)

Source: checkmarx f8ec6fb30a9cc9b60e000a681a139d826c6cb1894b8b4165ee448203aae2c444 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmvirtual (PyPI)

Source: checkmarx 14608e0e9092f41da3d40aaf76971290b0794f915e84d8b0dadc3624f84adffd EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmurl (PyPI)

Source: checkmarx ea5d2a4e4bcca19282b56954c06a1d051a44c8681f194b7f52397442e9a657a0 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmpost (PyPI)

Source: checkmarx 8127b6e866e541094a3578f0577e5eaa2d729e0c5d613184acfa007f14e9ed24 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmpip (PyPI)

Source: checkmarx acd3809745c4e80436d0bd3bc21b731e647cfd43dff10bf6719a5c1cbc05a988 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmpyw (PyPI)

Source: checkmarx 2d257e4df710c052159d1403166e1fd3d4e6ed0063d07e171d712d46cb1a18e9 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vminfo (PyPI)

Source: checkmarx 58ed865bdfa9990a893190e50b32a0f0a52443e8b607534294ead6de8db514c4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmre (PyPI)

Source: checkmarx 78f0dfda9eb88229c53aaa044687cc4855fb225942c54fd36d40954c59ad2605 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmmine (PyPI)

Source: checkmarx a28e36cd416b75db430037116b5f924a03753c6338e7ce6696b0810c710c0713 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmmc (PyPI)

Source: checkmarx 63ef956fcaf56d41933619be0bd6bbaa43590c0563f27d5e149e35a32700846c EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmgui (PyPI)

Source: checkmarx 379a1d83a0c2a6a60aee7ef4ab9fb4b2bd0e5de46bffc94b4233de74a8799d82 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmstudy (PyPI)

Source: checkmarx 1bf16497574b5d6fed677bdb29067831bb25b11210e36229d3a716855d8f074a EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmmask (PyPI)

Source: checkmarx 30aec37ee20d8f45782609b1b64d25e58472e4ac61727de9a99271b5b102cb63 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in visavm (PyPI)

Source: checkmarx 5d5ba790b5ea61c7a84b300f0fd915e60420f40baffcad2d159e7c03d9b69442 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmcv (PyPI)

Source: checkmarx c11bbc18eed90a16c9f97af431f82f876a541a8d4087d436495e6a195f4c4ee1 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...

Malicious code in vmcandy (PyPI)

Source: checkmarx 4285b6afb03d534af618b9806f55ba35b693b26e132baa7bae895ebb51c465a6 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware --- Credit: OpenSSF source...