Malicious code in streak-math-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e5ca17a73b4b4b7a21d7ccbad12df26ca3c6ad524689f2e1520bd34724b61fbb On module import, index.js decodes a hex-obfuscated string table to reconstruct a Backblaze B2 URL and a set of Windows filesystem paths, then gates...

MAL-2026-12464 Malicious code in streak-daybucket (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 799caca8e351ad8d1144b26eb0c38ffdf06afb415f63a320e6ea455968996aa0 [email protected] presents itself as a day-bucket / streak math utility but its index.mjs embeds a hex-encoded Windows PE binary leading 4D5A90...

Malicious code in streak-math-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6ba4f1a9b23ca375fed98868d8ca488ec722b473060834412b0b1b23f5cae37a [email protected] is advertised as a math primitives library but its index.mjs top-level IIFE bootstrap runs on any import and drops a hex-embedd...

MAL-2026-12433 Malicious code in saas-f-lego-landings (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0c96f58511420dcd956adbe21ee52dd1acae9956f5b562887a5c6659679fb52d [email protected] executes a native binary dropper as a side effect of loading the package. index.js unconditionally requires./support.js,...

Malicious code in twork-data-services-getting-arrests (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fcfe9505e3a40e8cd4c314f982901e6cbc0c988fbe6ae5fef58c6c1dc5b78a33 [email protected] acts as a binary dropper. index.js top-level requires./support.js, whose start runs at load time: it selec...

Malicious code in retracfix (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7656b934d52c542162613f35aa909400f46aa0dae186ef9d55667f048bdfdcd4 The npm package [email protected] ships with no documented functionality empty description, no README, no source, no dependencies and consists only of...

Malicious code in @types-beta/sdk (npm)

The npm package @types-beta/sdk is a supply-chain dropper that impersonates the trusted @types DefinitelyTyped namespace to look like a routine type-definition dependency. It bundles a Windows executable vendor/nanocache.exe and launches it as an import-time side effect: dist/index.js calls init ...

Malicious code in streak-core-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34 [email protected] presents itself as a 'day-math primitives' library, but index.mjs the package main, executed on any require/import contains an...

MAL-2026-11148 Malicious code in streak-core-lib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf01d1216cca4dbb1b7da58b70a710d7d04bff671d2889f8ca0d7837633dec34 [email protected] presents itself as a 'day-math primitives' library, but index.mjs the package main, executed on any require/import contains an...

Malvertising Sends Malware in Pieces, Then Makes the Browser Build the Executable

A malvertising operation dubbed SourTrade is making victims' browsers build the final Windows executable themselves, using a legitimate Bun runtime as its base instead of serving one complete malicious file from a fixed URL. Confiant, which detailed the campaign on July 23, 2026, said it has...

CVE-2026-47425

Rattler is a library that provides common functionality used within the conda ecosystem. Prior to version 0.43.2, EntryPoint::FromStr in rattlercondatypes performs only .trim on the command field before the linker joins it onto the install prefix and writes an executable Python script. A maliciou...

Malicious code in pystylish (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3a6a09e52477106b9586e89c2b0207bdc51e6d22dad500b7cc12a424d684c35b On import pystylish, the package's init.py spawns a daemon thread that downloads a Windows executable from https://goy.mikoz.xyz/boh3.exe, writes it ...

Malicious code in warp-dependency (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 493b3ed30d94fb482e4b9c7cf3d328ba9b307f91965783f0024ec7dca1fedb96 [email protected] declares postinstall: node index.js in package.json. The index.js entry point is heavily obfuscated using obfuscator.io-style...

CVE-2026-48831

A flaw was found in Wine. Wine's desktop file registers itself to handle Windows executable EXE files. In some configurations, opening an EXE file can cause it to run automatically with the user's permissions, without further prompts. This allows an attacker to bypass security sandboxes like...

Malicious code in clob.api (npm)

A campaign of npm packages sharing a common dropper clob.js that downloads and persistently installs a Windows executable from IPFS on postinstall. The dropper fetches the binary from IPFS CID bafybeif3zkapj364ofnrvbty7oj5h5ufpxlp4s62usk3ulxrru35e3gssa via multiple public gateways Pinata,...

CVE-2026-48831

Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap...

EUVD-2026-31599

Wine ships a .desktop file that registers itself as a MIME handler for EXE files and several other Windows executable file types. In some configurations, handling of an EXE file causes that file to be blindly executed with the permissions of the invoker. This allows escaping Flatpak and Snap...

CVE-2025-66863

An issue was discovered in function ddiscriminator in file cp-demangle.c in BinUtils 2.26 allows attackers to cause a denial of service via crafted PE file...

PT-2025-48495

Name of the Vulnerable Software and Affected Versions Avast Antivirus versions 16.0.0 on MacOS Avast Antivirus versions 3.0.3 on Linux Description A NULL pointer dereference issue exists in Avast Antivirus when scanning a malformed Windows PE file. This can cause the antivirus process to crash on...

Mozilla Firefox < 61.0

The version of Firefox installed on the remote Windows host is prior to 61.0. It is, therefore, affected by multiple vulnerabilities as referenced in the mfsa2018-15 advisory. - Mozilla developers and community members Alex Gaynor, Christoph Diehl, Christian Holler, Jason Kratzer, David Major, Jo...