notepadpp-supply-chain-iocs

Notepad++ Supply Chain Attack — IoC Repository CVE-2025-15556 | Lotus Blossom / Raspberry Typhoon | June – December 2025 Overview This repository contains a comprehensive, consolidated collection of Indicators of Compromise IoCs related to the Notepad++ supply chain attack disclosed on February 2...

MAL-2026-19108 Malicious code in raiden-baileys (npm)

Malicious package. raiden-baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. on connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...

MAL-2026-19059 Malicious code in @zanxiky/baileys (npm)

Malicious package. @zanxiky/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. on connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...

MAL-2026-18600 Malicious code in @ubedsockets/baileys (npm)

Malicious package. @ubedsockets/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. On connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...

CVE-2026-41567

CVE-2026-41567 1day One day for Docker Escape CVE-2026-41567. It is a demonstration of docker escape using trojanized xz / unpigz. It can be easily modified to be used remotely i.e. just modify the docker default IP with a remote C2. More information on the exploit here PoC Run a netcat listening...

Malicious code in raiden-baileys (npm)

Malicious package. raiden-baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. on connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...

Malicious code in @zhengliyoux/baileys (npm)

Malicious package. @zhengliyoux/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. it silently subscribes every victim via the injected WhatsApp newsletter/channel FOLLOW on connect to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs:...

Malicious code in @lekzsync/baileys (npm)

Malicious package. @lekzsync/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. it silently subscribes every victim via the injected WhatsApp newsletter/channel FOLLOW on connect to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs:...

Malicious code in @zanxiky/baileys (npm)

Malicious package. @zanxiky/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. on connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...

Malicious code in @vanzky/baileys (npm)

Malicious package. @vanzky/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. it silently subscribes every victim via the injected WhatsApp newsletter/channel FOLLOW on connect to attacker-controlled WhatsApp channels — hardcoded newsletter JIDs:...

Malicious code in @ubedsockets/baileys (npm)

Malicious package. @ubedsockets/baileys is a trojanized fork of the Baileys WhatsApp library @whiskeysockets/baileys. On connection it issues an authenticated w:mex newsletter FOLLOW mutation queryid 7871414976211147 that silently subscribes every victim to attacker-controlled WhatsApp channels —...

Malicious code in hardhat-promised (npm)

Source: amazon-inspector 306eed59a2a4d15563101a3bfde19c1d6d5e0c9152cb0f3d0f421331e075ef4e The npm package hardhat-promised impersonates the pino logger: it ships pino's README with pino shields.io badges linking to npmjs.com/package/pino, LICENSE, docs/, index.d.ts, and lib/ directory layout...

Malicious code in hardhat-promised (npm)

[email protected] was published to npm on 2026-10-06 13:59 UTC by user ryan.danial915 account's only package, created the same day. The name targets the Ethereum development tool hardhat. The package is a verbatim copy of the pino logger README, docs, lib/.js, SECURITY.md; the README badges...

Malicious code in hardhat-roof (npm)

Source: amazon-inspector 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26 The package presents itself as the pino logger — README, docs/, index.d.ts and LICENSE are copied from pinojs/pino and keywords advertise 'fast, logger, stream, json' — but the package name is 'hardhat-roof'...

Malicious code in hardhat-roof (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26 The package presents itself as the pino logger — README, docs/, index.d.ts and LICENSE are copied from pinojs/pino and keywords advertise 'fast,...

MAL-2026-17509 Malicious code in hardhat-roof (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 25cbf03ad6014824ab078237f83b2b682145928e5effefbe3dcc5deca9ba1e26 The package presents itself as the pino logger — README, docs/, index.d.ts and LICENSE are copied from pinojs/pino and keywords advertise 'fast,...

MSC-2026-11634

Trojanized mathjs clone. lusolve calls removeSolveValidation, which calls is.isGraph: it AES-256-GCM-decrypts a filename and a module from bundled ciphertext utils/graph.js, utils/fraction.js, utils/bignumber/type.js, writes the plaintext to disk and requires it, executing attacker-supplied code ...

Malicious code in @staticj/cropperxmjs (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector ac36a108b1e9c92a64955277bdfe9a09cdae61504e9a1bfaf40a15c50595139a @staticj/[email protected] ships a modified cropper.min.js that impersonates the legitimate Cropper.js library. At library load, injected code...

Malicious code in node-helper (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8e7475543fb41397ba49574f9b16340e671160b13bb100bb0db6c4acc2fb154e The package impersonates the legitimate blakeembrey/node-helper library matching author metadata, README, MIT license, and top-of-file helper functio...

New Ted Backdoor Hides Inside Victims' Own HAProxy Builds to Intercept Web Traffic

A previously undocumented Linux toolkit has been found compiled directly into the trojanized HAProxy load balancers of two South Korean organizations, where it intercepted web traffic and served altered pages to selected visitors. The attackers named the implant ted in debug strings left in the...