Malicious code in test-workalendar-internal (PyPI)

Source: kam193 9f36e976d0fcf254def6da62e0090bfb2dbdf76176ed316655574408c25cb9a0 During build, the package creates a web-sharable terminal session and exposes it via a Cloudflare tunnel to the attacker. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaig...

Malicious code in workcalender (PyPI)

Source: kam193 9a336c0fa7a5b3ee5f036d678c8c0f0d549135a08d05549ee92cb11b1a7f78fa This package contains a stub build-time helper, which in another package of the same uploader was already turned into a backdoor installation. While this package does not yet contain malicious code, it is clear it was...

Malicious code in resion (PyPI)

Source: kam193 2e9e3ce373adb26e45616eec47d727e557f5a696737cb2fbcaa66fb7dc7b7c3e Description: In this campaign, the main package resion has an embeded pickle disguised as a config. A related dependency pafex contains code to load the pickle. During unpickling, malicious code embeded in the pickle...

Malicious code in pafex (PyPI)

Source: kam193 8ad1f51a6f081ac9e46b3d3ffa2d0b9b150b1600caf826d940f4e3d1992cda16 In this campaign, the main package resion has an embeded pickle disguised as a config. A related dependency pafex contains code to load the pickle. During unpickling, malicious code embeded in the pickle file is...

@angular/router: Denial of Service via Unmatched Empty-Path Outlet Route Matching in Server-Side Rendering (SSR)

A denial of service DoS vulnerability was identified in @angular/router when Server-Side Rendering SSR is enabled on Node.js V8. During route recognition, @angular/router fails to validate whether an auxiliary outlet segment in the URL matches a route configured for that specific outlet name...

Hono: `serveStatic` decodes the request path a second time, leading to bypass of middleware on static paths

Summary serveStatic decodes the request path a second time after Hono has already decoded it for routing. A crafted request can be routed as one path and served as another, so middleware mounted on a static prefix does not run for a file under that prefix. Details Hono decodes the request path on...

@angular/platform-server: Open Redirect via Protocol-Relative URLs in Server-Side Rendering (SSR)

An open redirect vulnerability was identified in @angular/platform-server when Server-Side Rendering SSR is enabled. When Angular SSR renders an incoming request, URL resolution and platform navigation are managed by ServerPlatformLocation using resolveUrl or parseUrl in v20. While resolveUrl...

markdown-it: Quadratic complexity in smartquotes with unmatched closing quotes

Impact When typographer: true is enabled, specially crafted Markdown can cause quadratic processing time in the smartquotes rule, potentially leading to denial of service in applications processing untrusted input. Many opening double quotes followed by unmatched closing single quotes cause...

Compress/s2: Integer Overflow or Wraparound and Out-of-bounds Write in compress

Signed Integer Overflow in s2.NewDict Summary A signed integer overflow vulnerability in s2.NewDict allows an attacker to bypass repeat index validation by supplying a dictionary with a uvarint-encoded repeat value exceeding MaxInt64. When Dict.Encode is subsequently called, the overflowed negati...

Crass : Large numeric exponents cause CPU and memory denial of service

Impact Crass converts CSS scientific notation number values with unbounded exponentiation before it clamps the result to Float::MAX. Applications that use Crass to parse attacker-controlled CSS strings can be forced to spend disproportionate CPU and memory parsing a tiny input, possibly resulting...

Malicious code in @platform-services/hrm-mfe-core (npm)

Source: ossf-package-analysis c7552efe145088950a0df7a5c63da92a309a040fba2062a4d32bb59cadc9ec47 The OpenSSF Package Analysis project identified '@platform-services/hrm-mfe-core' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malicious code in tailwindcss-animatemotion (npm)

tailwindcss-animatemotion 1.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwindcss-visual-kit (npm)

tailwindcss-visual-kit 0.0.0-stage, 1.3.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...

Malicious code in tailwindcss-effect-lab (npm)

tailwindcss-effect-lab 0.0.0-stage, 1.6.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnsmith0821 on 2026-10-09. src/motion.js:5 requires the private scope...

Malicious code in tailwindcss-motionanimate (npm)

tailwindcss-motionanimate 1.0.1 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by doublekk61 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwindcss-animate-catalog (npm)

tailwindcss-animate-catalog 2.0.6, 2.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hackson306623 on 2026-09-28. lib/styles/variables.js:5 requires the...

Malicious code in ccl-global-shopping (npm)

Source: ossf-package-analysis 31f39d40e2c7700b1c070cbd26ea533789dc444daaf58e77d191f7eb10036fc9 The OpenSSF Package Analysis project identified 'ccl-global-shopping' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in fanarena-common (npm)

Source: ossf-package-analysis d81686cb5b877d15810946a299ba819a875a3304e45d65a3fdb83c5473ac664b The OpenSSF Package Analysis project identified 'fanarena-common' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious...

Malicious code in sc-announcer (npm)

Source: ossf-package-analysis 38abcbba47f18b6d76a06a770258c620fc322472d0db0d38b67f04805b916d43 The OpenSSF Package Analysis project identified 'sc-announcer' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity...

Malicious code in sc-wizard (npm)

Source: ossf-package-analysis 54691cc130e614ee031186f7e646c3e6076efad6105a6e9cad68f62aa736516b The OpenSSF Package Analysis project identified 'sc-wizard' @ 99.9.1 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. --...

Malicious code in tailwindcss-keyframe-kit (npm)

tailwindcss-keyframe-kit 3.0.0, 3.0.1, 3.0.2 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hackson306623 on 2026-09-28. src/generators/motion-base.js:5 require...

Malicious code in tailwind-fabric (npm)

tailwind-fabric 3.0.1, 3.0.4 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnxia1997 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-keyframes (npm)

tailwind-keyframes 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by adriannamrr on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-animate-kit (npm)

tailwind-animate-kit 2.0.6, 2.0.7, 2.0.8 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by keinsell-jh on 2026-09-28. src/motion.js:5 requires the private scoped...

Malicious code in animatecss-tailwind-helper (npm)

animatecss-tailwind-helper 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-plugin (npm)

animatecss-tailwind-plugin 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by hannahgibbs on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-luminary (npm)

animatecss-tailwind-luminary 2.0.6, 2.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by cypherbyte on 2026-09-28. src/motion.js:5 requires the private scoped...

Malicious code in signalledger-diagnostics (npm)

signalledger-diagnostics 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-animationlab (npm)

tailwind-animationlab 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by adriannamrr on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animate-twcss-pack (npm)

animate-twcss-pack 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by enterprise0908 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-css-keyframes (npm)

tailwind-css-keyframes 1.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by kinsleybadu on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-presets (npm)

animatecss-tailwind-presets 1.0.0, 2.0.3 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by elony16 on 2026-09-29. src/motion.js:5 requires the private scoped packa...

Malicious code in animate-tailwind-kit (npm)

animate-tailwind-kit 3.0.1, 3.0.4 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by johnxia1997 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in tailwind-animatecss-kit (npm)

tailwind-animatecss-kit 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by killerdev1127 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-binary (npm)

animatecss-tailwind-binary 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by jamesvectorpack on 2026-09-28. src/motion.js:5 requires the private scoped packa...

Malicious code in tailwind-animaflow-kit (npm)

tailwind-animaflow-kit 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by killerdev1127 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animate-twcss-bridge (npm)

animate-twcss-bridge 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by enterprise0908 on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-vectrix (npm)

animatecss-tailwind-vectrix 2.0.6, 2.0.7 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by cypherbyte on 2026-09-28. src/motion.js:5 requires the private scoped...

Malicious code in signalledger-bridge (npm)

signalledger-bridge 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by scott-rogers on 2026-09-28. src/motion.js:5 requires the private scoped package...

Malicious code in animatecss-tailwind-graphic (npm)

animatecss-tailwind-graphic 2.0.6 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by jamesvectorpack on 2026-09-28. src/motion.js:5 requires the private scoped...

Malicious code in tailwind-kinetic (npm)

tailwind-kinetic 2.0.6, 2.0.8 is a Tailwind CSS plugin from the fake job interview campaign behind MAL-2026-17665 and MAL-2026-17666: the same Animate.css integration template, README and description, published by keinsell-jh on 2026-09-28. src/motion.js:5 requires the private scoped package...

MLflow FileStore trace IDs allow path traversal and arbitrary file writes

MLflow 3.17.1 and earlier contains a path traversal vulnerability in the FileStore tracking backend that allows unauthenticated attackers to control filesystem paths by submitting a crafted trace ID containing traversal sequences to the POST /api/3.0/mlflow/traces endpoint. Attackers can exploit...

Malicious code in asurion (PyPI)

Source: kam193 05820dd77e1f73d1a01797af6f10c6fa4ae22038be3fcd6a8cbd8c117cf6436c Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malware in @an1mshnpmb9c84920/stage-repo-m19g7

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @an1mshnpmb9c84920/gat-scope-target-125ec19a

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @an1mshnpmb9c84920/stage-fn-m19p2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @an1mshnpmb9c84920/stage-outer-m19s5

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @an1mshnpmb9c84920/pipe-dns-m19t2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @an1mshnpmb9c84920/pipe-compat-m19r8

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @an1mshnpmb9c84920/oidc-cross-cafb9d929e

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...