Malicious code in seclab-research-depconf-test (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 71ecf56c682dd44134d9a4d17fb2ae3d20091681372f89902c84d5dc2533c03d Packages that might be part of testing for pentesting / malicious activity / joy, with suspicious activity that does not present any real harm. --- Category:...

Malicious code in 182-23run (npm)

The package is malicious due to HTML injection in index.js redirecting to adult/malicious sites and a YARA match on a suspicious URL...

MAL-2025-5831 Malicious code in 182-23run (npm)

The package is malicious due to HTML injection in index.js redirecting to adult/malicious sites and a YARA match on a suspicious URL...

MAL-2025-5173 Malicious code in myatt (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 642dc644bf145b2ed3bb5126b58d897d06442693fcfb6747ea553b87ab935bc3 The OpenSSF Package Analysis project identified 'myatt' @ 1.0.10 npm as malicious. It is considered malicious because: - The package communicate...

CVE-2024-12718 Bypass extraction filter to modify file metadata outside extraction directory

Allows modifying some file metadata e.g. last modified with filter="data" or file permissions chmod with filter="tar" of files outside the extraction directory. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...

CVE-2025-4138 Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...

CVE-2025-4138 Bypassing extraction filter to create symlinks to arbitrary targets outside extraction directory

Allows the extraction filter to be ignored, allowing symlink targets to point outside the destination directory, and the modification of some file metadata. You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or...

CVE-2025-4517 Arbitrary writes via tarfile realpath overflow

Allows arbitrary filesystem writes outside the extraction directory during extraction with filter="data". You are affected by this vulnerability if using the tarfile module to extract untrusted tar archives using TarFile.extractall or TarFile.extract using the filter= parameter with a value of...

A Flyby on the CFO's Inbox: Spear-Phishing Campaign Targeting Financial Executives with NetBird Deployment

A Flyby on the CFO's Inbox: Spear-Phishing Campaign Targeting Financial Executives with NetBird Deployment By Trellix · May 28, 2025 This blog was written by Srini Seethapathy Trellix wants to acknowledge thequick response from NetBird following our initial findings. NetBird acted immediately to...

kernel: ipv4: ip_tunnel: Fix suspicious RCU usage warning in ip_tunnel_find()

In the Linux kernel, the following vulnerability has been resolved: ipv4: iptunnel: Fix suspicious RCU usage warning in iptunnelfind The per-netns IP tunnel hash table is protected by the RTNL mutex and iptunnelfind is only called from the control path where the mutex is taken. Add a lockdep...

MAL-2025-3664 Malicious code in @ai-document-translation/ui-core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware c8c94ea05205ad6ac8c809be2fa22e18fae368f27f1f8bd34048528dc25daa90 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Threat Exposure Indicators Detected (Critical)

Intrusion detection events may indicate that the network has been compromised and is exposed to malicious entities. It is important to be aware of any such traffic that may indicate reconnaissance activity, attacks on the network, or propagation of a threat to/from other subnets of the network...

Threat Exposure Indicators Detected (Low)

Intrusion detection events may indicate that the network has been compromised and is exposed to malicious entities. It is important to be aware of any such traffic that may indicate reconnaissance activity, attacks on the network, or propagation of a threat to/from other subnets of the network...

MAL-2025-3222 Malicious code in web-sim-control (npm)

--- -= Per source details. Do not edit below this line.=- Source: ossf-package-analysis 8d3b8a674300adbbebf266b874c5c0505e514bace39bd005a46f18525cd3eb16 The OpenSSF Package Analysis project identified 'web-sim-control' @ 1.0.0 npm as malicious. It is considered malicious because: - The package...

CVE-2025-31200

creationtimestamp| type| source ---|---|--- 2025-04-16 17:33:02+00:00| seen| https://infosec.exchange/users/applsec/statuses/114348836934305541 2025-04-16 17:33:04+00:00| seen| https://bsky.app/profile/applsec.bsky.social/post/3lmx4qr3utx2e 2025-04-16 18:18:24+00:00| seen|...

“Follow me” to this fake crypto exchange to claim $500

A type of crypto scam that we reported about in 2024 has ported over to a new platform and changed tactics—a bit. Where the old scams mostly reached me on WhatsApp, the same group of scammers is now using Direct Messages on X. However, the same old trick of "accidentally" sending you login detail...

Palo Alto Networks Warns of Brute-Force Attempts Targeting PAN-OS GlobalProtect Gateways

Palo Alto Networks has revealed that it's observing brute-force login attempts against PAN-OS GlobalProtect gateways, days after threat hunters warned of a surge in suspicious login scanning activity targeting its appliances. "Our teams are observing evidence of activity consistent with...

MAL-2025-2734 Malicious code in dmpconnectjsapp-base (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d21050916c0e5222db92b8c6056e3a60fbf54f55cebefb5509a15453c20d68b7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

CVE-2025-21876

In the Linux kernel, the following vulnerability has been resolved: iommu/vt-d: Fix suspicious RCU usage Commit "iommu/vt-d: Allocate DMAR fault interrupts locally" moved the call to enabledrhdfaulthandling to a code path that does not hold any lock while traversing the drhd list. Fix it by...

MAL-2025-2623 Malicious code in corehome (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 835efaf181707862582cf58938ea26bb25e18a1d228269a42b58f12d1c250ca7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...