MAL-2026-403 Malicious code in worldnormal (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 406eb16c91569acae88fa2f33de6107f6a758568c40b800908ac924d1a7e87fd The package worldnormal was found to contain malicious code. Source: ghsa-malware 1c9bf70b2f92f241477ec0cae21b7f094e1d4d1090cbb837bfd90fa9430f26ac An...

Malicious code in victim-package-b (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 152e8188fd82f0ea4ee410d725bb96ab33af5767241fcefb555ef8dfaffd39bf The package victim-package-b was found to contain malicious code. Source: ghsa-malware 324aadc54f696916c968e82f4704d088384eab1ce76c08f2a3d3d0aa59fece...

Finite-Size Security of QKD: Comparison of Three Proof Techniques

We compare three proof techniques for composable finite-size security of quantum key distribution under collective attacks, with emphasis on how the resulting secret-key rates behave at practically relevant block lengths. As a benchmark, we consider the BB84 protocol and evaluate finite-size...

Decision-Aware Trust Signal Alignment for SOC Alert Triage

Detection systems that utilize machine learning are progressively implemented at Security Operations Centers SOCs to help an analyst to filter through high volumes of security alerts. Practically, such systems tend to reveal probabilistic results or confidence scores which are ill-calibrated and...

MAL-2026-70 Malicious code in @shop-cicd/webpack-package-artifact (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2ee6154f54d35f10e1bca4b64111deef6ab6c43c9ea291a7adfac091b7334ab0 The package @shop-cicd/webpack-package-artifact was found to contain malicious code. Source: ghsa-malware...

CVE-2025-15449

CVE-2025-15449 affects the JavaMall project, specifically the delete function in MinioController.java, where manipulating the objectName argument enables path traversal. This vulnerability can be exploited remotely; affected versions are before 994f1e2b019378ec9444cdf3fce2d5b5f72d28f0. Multiple c...

MAL-2025-192978 Malicious code in tailwindcss-typography-style (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8f2e4636e4f08bc04591afc5b27fce2e03dea82a9883b2dc8092a6f23fa6f55d The package tailwindcss-typography-style was found to contain malicious code. Source: ghsa-malware...

Uncertainty in Security: Managing Cyber Senescence

My main worry, and the core of my research, is that our cybersecurity ecosystem is slowly but surely aging and getting old and that aging is becoming an operational risk. This is happening not only because of growing complexity, but more importantly because of accumulation of controls and measure...

Enhancing Decision-Making in Windows PE Malware Classification during Dataset Shifts with Uncertainty Estimation

Artificial intelligence techniques have achieved strong performance in classifying Windows Portable Executable PE malware, but their reliability often degrades under dataset shifts, leading to misclassifications with severe security consequences. To address this, we enhance an existing LightGBM...

Deep Reinforcement Learning for Phishing Detection with Transformer-Based Semantic Features

Phishing is a cybercrime in which individuals are deceived into revealing personal information, often resulting in financial loss. These attacks commonly occur through fraudulent messages, misleading advertisements, and compromised legitimate websites. This study proposes a Quantile Regression De...

Quantum Key Distribution: Bridging Theoretical Security Proofs, Practical Attacks, and Error Correction for Quantum-Augmented Networks

Quantum Key Distribution QKD is revolutionizing cryptography by promising information-theoretic security through the immutable laws of quantum mechanics. Yet, the challenge of transforming these idealized security models into practical, resilient systems remains a pressing issue, especially as...

Malicious code in @lui-ui/lui-nuxt (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector aeaeb0138ac2e77901a8360aeeeec1038e7da06fabc4c4726a6fb2060f8d01b5 The package @lui-ui/lui-nuxt was found to contain malicious code. Source: ghsa-malware 7914345d453dc4753973e462d6f8e4cbd4d25656c98b9a22f073c9fdddb715...

Malicious code in @ensdomains/solsha1 (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5c4a8798162224fba85c25e8c01bb31790ea20f33f47fbe558eb659c197e0a4e The package @ensdomains/solsha1 was found to contain malicious code. Source: ghsa-malware...

Future-Back Threat Modeling: A Foresight-Driven Security Framework

Traditional threat modeling remains reactive-focused on known TTPs and past incident data, while threat prediction and forecasting frameworks are often disconnected from operational or architectural artifacts. This creates a fundamental weakness: the most serious cyber threats often do not arise...

Injecting Falsehoods: Adversarial Man-In-The-Middle Attacks Undermining Factual Recall in LLMs

LLMs are now an integral part of information retrieval. As such, their role as question answering chatbots raises significant concerns due to their shown vulnerability to adversarial man-in-the-middle MitM attacks. Here, we propose the first principled attack evaluation on LLM factual memory unde...

Malicious code in @chatclub/claude-code (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b6acfccb78a615c7f037fe5dbd1001d9a77ca4015c89c94122ba5dd78978b66b The package @chatclub/claude-code was found to contain malicious code. Source: ghsa-malware...

Trustworthy Quantum Machine Learning: A Roadmap for Reliability, Robustness, and Security in the NISQ Era

Quantum machine learning QML is a promising paradigm for tackling computational problems that challenge classical AI. Yet, the inherent probabilistic behavior of quantum mechanics, device noise in NISQ hardware, and hybrid quantum-classical execution pipelines introduce new risks that prevent...

MAL-2025-48570 Malicious code in mender-conductor (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2aa35f37c40538fc027dc3f86e83c914f7285a8968a9811e5bbc8a5fc5b863da Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2025-48540 Malicious code in @jd-org/clear-server (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d6d11360da81f86749d64e1c01171518474b7c636f9f729440f0a79dd1608e37 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in matrix-charts (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ec928e940d4a9d80d7e512630b842c44283854acb9421a3ecb97c288f07fb7a2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...