LFreeDA: Label-Free Drift Adaptation for Windows Malware Detection

Machine learning ML-based malware detectors degrade over time as concept drift introduces new and evolving families unseen during training. Retraining is limited by the cost and time of manual labeling or sandbox analysis. Existing approaches mitigate this via drift detection and selective...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in eslint-config-prettier

Summary IBM Watson Discovery Cartridge contains a vulnerable version of eslint-config-prettier Vulnerability Details CVEID:CVE-2025-54313 DESCRIPTION: eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package...

SilentSync RAT Delivered via Two Malicious PyPI Packages Targeting Python Developers

Cybersecurity researchers have discovered two new malicious packages in the Python Package Index PyPI repository that are designed to deliver a remote access trojan called SilentSync on Windows systems. "SilentSync is capable of remote command execution, file exfiltration, and screen capturing,"...

CHILLYHELL macOS Backdoor and ZynorRAT RAT Threaten macOS, Windows, and Linux Systems

Cybersecurity researchers have discovered two new malware families, including a modular Apple macOS backdoor called CHILLYHELL and a Go-based remote access trojan RAT named ZynorRAT that can target both Windows and Linux systems. According to an analysis from Jamf Threat Labs, ChillyHell is writt...

Demystifying the Role of Rule-Based Detection in AI Systems for Windows Malware Detection

Malware detection increasingly relies on AI systems that integrate signature-based detection with machine learning. However, these components are typically developed and combined in isolation, missing opportunities to reduce data complexity and strengthen defenses against adversarial EXEmples,...

Node.js Multiple Packages Embedded Malicious Code (CVE-2025-54313)

Multiple nodejs packages were embedded with malicious code. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows. The following nodejs packages and versions are affected: - @pkgr/core 0.2.8 - eslint-config-prettier 8.10.1, 9.1.1, 10.1.6,...

Malicious Go, npm Packages Deliver Cross-Platform Malware, Trigger Remote Data Wipes

Cybersecurity researchers have discovered a set of 11 malicious Go packages that are designed to download additional payloads from remote servers and execute them on both Windows and Linux systems. "At runtime the code silently spawns a shell, pulls a second-stage payload from an interchangeable...

Exploit for CVE-2017-0144

This repository is an offensive tool for Windows. It is an implementation of the DoublePulsar backdoor in C/C++. The tool includes a suite of exploits and detectors for various vulnerabilities, including the EternalBlue vulnerability CVE-2017-0144. The tool can be used to upload a DLL to a...

Malicious code in eslint-config-prettier (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2025-6023 Malicious code in eslint-plugin-prettier (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2025-6021 Malicious code in @pkgr/core (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2025-6025 Malicious code in napi-postinstall (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

Malicious code in napi-postinstall (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2025-6026 Malicious code in synckit (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

Malicious code in got-fetch (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

Malicious code in synckit (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

Malicious code in eslint-plugin-prettier (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2025-6024 Malicious code in got-fetch (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

MAL-2025-6022 Malicious code in eslint-config-prettier (npm)

This package installs a windows based malware file node-gyp.dll via install.js...

eslint-config-prettier, eslint-plugin-prettier, synckit, @pkgr/core, napi-postinstall have embedded malicious code

eslint-config-prettier 8.10.1, 9.1.1, 10.1.6, and 10.1.7 has embedded malicious code for a supply chain compromise. Installing an affected package executes an install.js file that launches the node-gyp.dll malware on Windows...