MAL-2026-11415 Malicious code in aichannel (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 21e18e6e4016bf07f11edb272a08fb26268b2fbfe0b42a4ba502df368ce05b01 In this campaign, some packages e.g. cognikit, aiassistcore are pulled as dependencies and contain the C2 configuration and the malicious functionality, while...

Two Compromised joyfill npm Packages Run RAT When Imported Into Node.js

Beta release versions of two npm packages in the @joyfill namespace have been compromised to deliver a remote access trojan RAT associated with the DEVPOPPER malware family. The list of affected packages is as follows - @joyfill/[email protected] @joyfill/[email protected]...

Cruciferra Crypter Uses BYOVD and Process Ghosting to Hide Windows Malware

The China-linked cybercrime group behind the use of income tax-related phishing lures targeting Indian taxpayers, tax professionals, and corporate finance teams has been observed using a sophisticated crypter service called Cruciferra. According to a new analysis by Proofpoint, Cruciferra has bee...

Seven Malicious Vite npm Packages Use Blockchain C2 to Deliver a RAT

Cybersecurity researchers have discovered a cluster of seven malicious npm packages targeting the Vite frontend tooling ecosystem as part of a software supply chain attack. The malicious package campaign, codenamed ViteVenom by Checkmarx, marks an expansion of ChainVeil , which was observed using...

Fake Coding Tests Deliver OtterCookie-Aligned Malware Hidden in SVG Flag Images

North Korean threat actors linked to the Contagious Interview campaign have been observed employing steganography in SVG image files to conceal malicious payloads as part of a campaign using fake job postings and coding challenges. "Any user who ran the project ended up with a four-stage payload...

Malicious code in @bcryptln/becryptjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cb86f48a4b796f17dc1017a92153b88afce1f15690687eaa422162d9dd9f347d Package @bcryptln/becryptjs impersonates the widely-used bcryptjs library its own metadata still references the upstream dcodeIO/bcrypt.js project. T...

MAL-2026-10057 Malicious code in chunk-parser (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8ffcc87316488b883c382ff45dd16c0bccb3cba432351f0716f239f81be79017 The package advertises itself as a 'Pure Node.js chunk parser platform' but its shipped code is a full remote-access trojan under internal identifier...

Important: docker

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Important: docker

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Important: docker

Issue Overview: x509.Certificate.VerifyHostname previously called matchHostnames in a loop over all DNS Subject Alternative Name SAN entries. This caused strings.Splithost, "." to execute repeatedly on the same input hostname. With a large DNS SAN list, verification costs scaled quadratically bas...

Suspected China-Nexus Hackers Use Fake Indian Tax Filing Utility to Deploy DcRAT

A suspected China-nexus threat activity cluster has been observed targeting Indian taxpayers, tax professionals, and corporate finance teams to deliver a remote access trojan designed to steal sensitive data from compromised hosts. The multi-stage campaign, codenamed Operation DragonReturn by...

New Java-Based QuimaRAT MaaS Built to Run on Windows, Linux, and macOS

Cybersecurity researchers have flagged a novel Java-based remote access trojan RAT called QuimaRAT that's capable of targeting Windows, Linux, and macOS environments. According to LevelBlue, the cross-platform malware is advertised under a malware-as-a-service MaaS model, costing anywhere between...

Ousaban Banking Trojan Targets Iberian Bank Users with Fake PDF Lures

A Brazilian banking trojan called Ousaban is going after Windows users who bank in Spain and Portugal. Fortinet's FortiGuard Labs identified the campaign in May 2026. It opens with a phishing PDF disguised as a corrupted file, checks that the visitor is really in Spain or Portugal, and hides its...

MAL-2026-6672 Malicious code in ulid-xyz (npm)

ulid-xyz is a typosquat of the popular ulid library sortable unique IDs and is a cross-platform Remote Access Trojan delivered via a postinstall hook. The package.json postinstall superficially looks like an inline node -e guard that checks for the existence of a dist file, but it actually launch...

Malicious code in ulid-xyz (npm)

ulid-xyz is a typosquat of the popular ulid library sortable unique IDs and is a cross-platform Remote Access Trojan delivered via a postinstall hook. The package.json postinstall superficially looks like an inline node -e guard that checks for the existence of a dist file, but it actually launch...

Malicious code in ts-escrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9607025df61aa1728bceb1a71534460a9e9edf2f3cd1d4eedd533238786577c2 [email protected] is a verbatim copy of the big.js library README, repository URL, author, version banner, and description all impersonate MikeMcl/big....

MAL-2026-6320 Malicious code in ts-escrow (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9607025df61aa1728bceb1a71534460a9e9edf2f3cd1d4eedd533238786577c2 [email protected] is a verbatim copy of the big.js library README, repository URL, author, version banner, and description all impersonate MikeMcl/big....

Malicious code in security-alerts-sdk (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f881805b709189d00bc52dc57c407bfecdae44fb343f92634a301c31525f6b0 Despite advertising itself as a breach-monitoring SDK, this package executes a remote-access trojan and credential harvester against any installer th...

MAL-2026-6322 Malicious code in ts-predict-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7efbafcedfb49da5093c3972473a549694dd9dd748281a299034c31578db1943 Package is published as ts-predict-helper but ships a byte-equivalent copy of big.js v7.0.1's source and README which states 'No dependencies', along...

Malicious code in forge-jsx4 (npm)

forge-jsx4 is a remote access trojan RAT published to the public npm registry by the account rafaelsilva [email protected]. Versions 1.0.122 and 1.0.123 were published on June 21-22, 2026 as a reconstitution of the forge-jsx / forge-jsxy campaign, reusing the same command-and-control...