Malicious code in payne-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b280e846739da7032c1c527d6bf7afa69a2848058f0dc711fa6bc6e613fc343f This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

Malicious code in bowman-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 8a965f573dd8cb4c850ac9d4d8fa40b35ed92674b733c6cb13155ae80c3efeb2 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-105305 Malicious code in lois-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7a0fd2b06f58b94c952abdab84d1d3c7532ca82250d2bbb33052eac9e89c6561 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-106994 Malicious code in paul-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector db8cf922668e45902b44020c344fcec70fd3ff8e171a1a8842d53f64f707fb63 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-101345 Malicious code in dennis-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector d0aee09a906657945eb76a1fbe22e2063823f65be311f206d8c2affab6924e4d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100198 Malicious code in bush-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6a49a10a9e614afaf70f2bfd3d7782510aec4637b7bfb502f41bae3ac31459f6 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100145 Malicious code in buckley-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 72de481f3e0ed593e360aa03da4ad9fbc2342e8bbe146ccb8f381cab60453bdf This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-100273 Malicious code in carpenter-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 9de1eef867a523bc2a18bf9c404d407218f894d0cd04ad930c8daea5d8a95f03 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-99944 Malicious code in bernadine-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 200470edfe267ebe9ad3d388dd8e648ce3884180c5547c0bdf3717f7fd35eb7d This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

MAL-2025-103848 Malicious code in hunter-wallet-store (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 81dfe058364f4d3484bdf1c7d85ba00554711dfc68fa28608a209d637beacd03 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...

WordPress plugin Crypto 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. An Access...

Social Engineering People’s Credit Card Details

Good Wall Street Journal article on criminal gangs that scam people out of their credit card information: Your highway toll payment is now past due, one text warns. You have U.S. Postal Service fees to pay, another threatens. You owe the New York City Department of Finance for unpaid traffic...

Supply Chain Attack

@metamask/sdk, @metamask/sdk-communication-layer, and @metamask/sdk-react are vulnerable to Supply Chain Attack. The vulnerability is due to a compromised debug package that injected malicious code, allowing attackers to intercept or tamper with dApp-to-wallet communications...

stealer

Stealer C stealer Chrome, Opera ,Chromium ,Edg...

Fake Nethereum NuGet Package Used Homoglyph Trick to Steal Crypto Wallet Keys

Cybersecurity researchers have uncovered a new supply chain attack targeting the NuGet package manager with malicious typosquats of Nethereum, a popular Ethereum .NET integration platform, to steal victims' cryptocurrency wallet keys. The package, Netherеum.All, has been found to harbor...

NK’s Famous Chollima Use BeaverTail and OtterCookie Malware in Job Scam

North Korea's Famous Chollima is back, merging BeaverTail and OtterCookie malware to target job seekers. Cisco Talos details the new threat. Keylogging, screen recording, and cryptocurrency wallet theft detected in an attack...

Video call app Huddle01 exposed 600K+ user logs

The Cybernews research team found that video call app Huddle01 exposed email addresses, real names, and other identifiers through an unprotected Kafka broker. Think of an unprotected Kafka broker like a post office that stores and delivers confidential mail. Now, imagine the manager leaves the...

A week in security (October 6 – October 12)

Last week on Malwarebytes Labs: Apple voices concerns over age-check law that could put user privacy at risk Your passwords don’t need so many fiddly characters, NIST says Millions of very private chats exposed by two AI companion apps Fake VPN and streaming app drops malware that drains your ban...

Don’t connect your wallet: Best Wallet cryptocurrency scam is making the rounds

Phishers and scammers can’t get enough of sending their feeble attempts to Malwarebytes’ employees. For which we can’t thank them enough because it means we can warn you, our readers. This time the scammers tried to impersonate Best Wallet—an app that lets people store, send, and receive...

Malicious Package

Overview @raydium-utils-v5/fetch-wallet-balance is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization...