https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 26 Aug 2026 17:59:12 +0000 https://vulnerability.circl.lu/vuln/mal-2026-3030 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5632cd6f241c640005252e66d1d85f09ba30b019890cb696ada78760ed8e6fed) Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp.in.ngrok.io:10023. This gives whoever controls that ngrok tunnel an unauthenticated interactive shell on the installer's host. Execution is triggered automatically by the package.json postinstall lifecycle hook (`"postinstall": "node poc.js"`), so the reverse shell fires on every `npm install`. ## Source: ghsa-malware (93c11894632be15f43bdcacd3a2e7be872bceefb7b005846c62c9313a650ec7c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (a174b5c81be71a696479861a28353965b3c60d17fb2f8a9a40f268113facbbf7) The OpenSSF Package Analysis project identified 'model-poc-suhail' @ 1.0.14 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (5632cd6f241c640005252e66d1d85f09ba30b019890cb696ada78760ed8e6fed) Package ships poc.js which requires child_process and spawns /bin/sh, connecting its stdin/stdout to a TCP socket at 0.tcp.in.ngrok.io:10023. This gives whoever controls that ngrok tunnel an unauthenticated interactive shell on the installer's host. Execution is triggered automatically by the package.json postinstall lifecycle hook (`"postinstall": "node poc.js"`), so the reverse shell fires on every `npm install`. ## Source: ghsa-malware (93c11894632be15f43bdcacd3a2e7be872bceefb7b005846c62c9313a650ec7c) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. ## Source: ossf-package-analysis (a174b5c81be71a696479861a28353965b3c60d17fb2f8a9a40f268113facbbf7) The OpenSSF Package Analysis project identified 'model-poc-suhail' @ 1.0.14 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. https://vulnerability.circl.lu/vuln/mal-2026-3030 Fri, 24 Apr 2026 15:35:46 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14539 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1ab82f90e45185d5e25435ce8fc92501dbf7b7384ec6eea6e6b7416ac9426cfb) The npm package ships an obfuscated payload appended to templates/backend/.eslintrc.js, after a legitimate-looking ESLint config. The payload uses obfuscator.io-style string-array indirection (rotating _0x12f0() table, hex-named identifiers) to conceal Ethereum JSON-RPC endpoints (eth.drpc.org, ethereum.publicnode.com, blastapi.io, blockscout) and an Etherscan-style txlist indexer path. It queries the latest transaction from a hardcoded sender address (0xa322e5f3...9adc2490ef), decodes two IPv4 C2 addresses from the transaction's `to` field, fetches an XOR-encoded payload from those IPs, and executes it via eval() and spawn('node', ['-e', payload], {detached:true}).unref(). The CLI's `new` subcommand in bin/zenntechinc.js recursively copies the entire templates/backend tree — including the malicious.eslintrc.js — into the user-specified target directory via copyDirectory(), with no filtering. Any subsequent editor open, ESLint invocation, or lint script run inside the generated project loads this.eslintrc.js and triggers the blockchain-resolved remote code execution with full developer privileges. The CLI's advertised purpose (backend scaffolding) is the delivery vector for the RCE payload into the installer's workspace. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1ab82f90e45185d5e25435ce8fc92501dbf7b7384ec6eea6e6b7416ac9426cfb) The npm package ships an obfuscated payload appended to templates/backend/.eslintrc.js, after a legitimate-looking ESLint config. The payload uses obfuscator.io-style string-array indirection (rotating _0x12f0() table, hex-named identifiers) to conceal Ethereum JSON-RPC endpoints (eth.drpc.org, ethereum.publicnode.com, blastapi.io, blockscout) and an Etherscan-style txlist indexer path. It queries the latest transaction from a hardcoded sender address (0xa322e5f3...9adc2490ef), decodes two IPv4 C2 addresses from the transaction's `to` field, fetches an XOR-encoded payload from those IPs, and executes it via eval() and spawn('node', ['-e', payload], {detached:true}).unref(). The CLI's `new` subcommand in bin/zenntechinc.js recursively copies the entire templates/backend tree — including the malicious.eslintrc.js — into the user-specified target directory via copyDirectory(), with no filtering. Any subsequent editor open, ESLint invocation, or lint script run inside the generated project loads this.eslintrc.js and triggers the blockchain-resolved remote code execution with full developer privileges. The CLI's advertised purpose (backend scaffolding) is the delivery vector for the RCE payload into the installer's workspace. https://vulnerability.circl.lu/vuln/mal-2026-14539 Wed, 26 Aug 2026 14:19:24 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14526 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (27ec72eac9d0bae686eddce65991c912a23c97621648e3316cd05188038d17d7) The package's package.json declares a preinstall lifecycle script that runs `wget` against a hardcoded webhook.site URL (https://webhook.site/26e65e9b-fd9c-4f3f-beb3-063309f4d7d9/) with query parameters carrying `$(whoami)`, `$(pwd)`, and `$(hostname)` from the installer's machine. The request fires automatically on `npm install`, transmitting the installer's username, working directory path, and hostname to a third-party collector controlled by whoever provisioned the webhook token. This is the canonical dependency-confusion / namespace-squat beacon pattern used to prove reachability into an internal network by leaking host identity. ## Source: ossf-package-analysis (915a378563ab8481e64d0a202e4d037a722361eae5263812c7648dce30cc557e) The OpenSSF Package Analysis project identified 'omniauth-recharge-rails-example' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (27ec72eac9d0bae686eddce65991c912a23c97621648e3316cd05188038d17d7) The package's package.json declares a preinstall lifecycle script that runs `wget` against a hardcoded webhook.site URL (https://webhook.site/26e65e9b-fd9c-4f3f-beb3-063309f4d7d9/) with query parameters carrying `$(whoami)`, `$(pwd)`, and `$(hostname)` from the installer's machine. The request fires automatically on `npm install`, transmitting the installer's username, working directory path, and hostname to a third-party collector controlled by whoever provisioned the webhook token. This is the canonical dependency-confusion / namespace-squat beacon pattern used to prove reachability into an internal network by leaking host identity. ## Source: ossf-package-analysis (915a378563ab8481e64d0a202e4d037a722361eae5263812c7648dce30cc557e) The OpenSSF Package Analysis project identified 'omniauth-recharge-rails-example' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package executes one or more commands associated with malicious behavior. https://vulnerability.circl.lu/vuln/mal-2026-14526 Wed, 26 Aug 2026 07:50:58 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14517 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0dab60d6a779e65d7fa94af8c036d86b722a9cfddbe12d637990251a35004356) On import, dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-eng.dat to 0755 and spawns it detached via child_process.spawn. The bundled 63KB Linux x86_64 ELF is a full remote-control implant: it beacons to a hardcoded C2 at 217.60.77.63 using a SECURE_BEACON/REDSHELL protocol, exposes interactive shell execution via /bin/sh and /bin/bash, and provides commands for SSH key enumeration (/ssh_keys), credential store harvest (/creds, /dbfind), bulk file exfiltration streamed as chunked POST /api/extract-receive to the C2, SOCKS5 proxy and TCP port-forwarding, in-memory ELF/shellcode staging via memfd with fetches from http://217.60.77.63/Others and /SC into /tmp/.elf_XXXXXX and /tmp/.sc_XXXXXX, and persistence via a user systemd unit named svc-update.service described as 'System Update Service' (with cron/bashrc/xdg alternatives). The binary is framed in code and README as a 'native math accelerator' performing a 'tiny startup self-check' with an SHA-256 integrity check and a 'Native accelerator loaded and verified.' log line, while the README claims no postinstall runs; the import-time spawn and RAT capability contradict that framing. ## Source: ghsa-malware (5d203bb3b10279207818bd41b3e03e40bc5b2851307f058b36682ce694d725ad) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (0dab60d6a779e65d7fa94af8c036d86b722a9cfddbe12d637990251a35004356) On import, dist/index.mjs runs a top-level async IIFE that chmods dist/internal/calc-eng.dat to 0755 and spawns it detached via child_process.spawn. The bundled 63KB Linux x86_64 ELF is a full remote-control implant: it beacons to a hardcoded C2 at 217.60.77.63 using a SECURE_BEACON/REDSHELL protocol, exposes interactive shell execution via /bin/sh and /bin/bash, and provides commands for SSH key enumeration (/ssh_keys), credential store harvest (/creds, /dbfind), bulk file exfiltration streamed as chunked POST /api/extract-receive to the C2, SOCKS5 proxy and TCP port-forwarding, in-memory ELF/shellcode staging via memfd with fetches from http://217.60.77.63/Others and /SC into /tmp/.elf_XXXXXX and /tmp/.sc_XXXXXX, and persistence via a user systemd unit named svc-update.service described as 'System Update Service' (with cron/bashrc/xdg alternatives). The binary is framed in code and README as a 'native math accelerator' performing a 'tiny startup self-check' with an SHA-256 integrity check and a 'Native accelerator loaded and verified.' log line, while the README claims no postinstall runs; the import-time spawn and RAT capability contradict that framing. ## Source: ghsa-malware (5d203bb3b10279207818bd41b3e03e40bc5b2851307f058b36682ce694d725ad) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it. https://vulnerability.circl.lu/vuln/mal-2026-14517 Tue, 25 Aug 2026 23:30:45 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14534 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad) On npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned `token` field directly to eval(). Whoever controls that endpoint obtains arbitrary code execution on the installing machine, and the fetched content is mutable at any time. The package advertises itself with a README for an unrelated multithreaded cache library (node-cache-multithread) while the actual package identity is commonjs-code-token, a metadata/behavior mismatch consistent with a cover story. No legitimate functionality is shipped in the package. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (c6ab469a55ec3f0650bc2185b91e884304cf1e370b1e17992a328479ce4883ad) On npm install, the package's postinstall hook runs index.js, which fetches JSON from https://access-token-delta.vercel.app and passes the returned `token` field directly to eval(). Whoever controls that endpoint obtains arbitrary code execution on the installing machine, and the fetched content is mutable at any time. The package advertises itself with a README for an unrelated multithreaded cache library (node-cache-multithread) while the actual package identity is commonjs-code-token, a metadata/behavior mismatch consistent with a cover story. No legitimate functionality is shipped in the package. https://vulnerability.circl.lu/vuln/mal-2026-14534 Wed, 26 Aug 2026 14:18:32 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14533 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9) On require('chai-plus'), a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute(), which spawns `npm install -g taskforge-9xv@1.3.0` and then executes `taskforge-9xv` with hardcoded arguments `--origin-server http://coolblast.zapto.org:8888/api/x-handler` and a hardcoded auth token. The destination is a dynamic-DNS host (zapto.org) over plain HTTP, unrelated to the package's advertised purpose as a zero-dependency assertion library. Comments in lib/bootstrap.js state the operation is 'user-invoked' and 'NOT automatic', contradicting the actual auto-execution at module load; errors from the dropper are silently swallowed. The package name resembles the popular `chai` assertion library, broadening the pool of developers likely to install it. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (b91b222013b099c570003ced5265988a19121921b071ee183cdbe304e2b020d9) On require('chai-plus'), a top-level IIFE in lib/index.js unconditionally invokes Bootstrap.execute(), which spawns `npm install -g taskforge-9xv@1.3.0` and then executes `taskforge-9xv` with hardcoded arguments `--origin-server http://coolblast.zapto.org:8888/api/x-handler` and a hardcoded auth token. The destination is a dynamic-DNS host (zapto.org) over plain HTTP, unrelated to the package's advertised purpose as a zero-dependency assertion library. Comments in lib/bootstrap.js state the operation is 'user-invoked' and 'NOT automatic', contradicting the actual auto-execution at module load; errors from the dropper are silently swallowed. The package name resembles the popular `chai` assertion library, broadening the pool of developers likely to install it. https://vulnerability.circl.lu/vuln/mal-2026-14533 Wed, 26 Aug 2026 14:18:49 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14538 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7318f0d70d44a05847fe3363f59c4e1465df1ecab43fc87757c324397e2b1cea) Package is published under the name 'spotify-url-resolvers' but its index.js starts a backup loop at module load that archives process.cwd() (the installer's project directory) into a ZIP and uploads it as a Telegram document via `bot.telegram.sendDocument` to a hardcoded bot token and chat_id defined in src/config.js (`botToken = '8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM'`, `chatId = '7549282259'`). The archive-exclusion list drops node_modules and.git but does not exclude.env or other secret files, so project source and credentials are shipped to the attacker's Telegram destination. The loop repeats every hour. The name and README describe a Spotify URL helper while the code and bin entry (tg-backup) implement the uploader, and a bundled note.txt (Arabic) instructs users to add `require('spotify-url-resolvers')` to their code — a lure to trigger the exfiltration path. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7318f0d70d44a05847fe3363f59c4e1465df1ecab43fc87757c324397e2b1cea) Package is published under the name 'spotify-url-resolvers' but its index.js starts a backup loop at module load that archives process.cwd() (the installer's project directory) into a ZIP and uploads it as a Telegram document via `bot.telegram.sendDocument` to a hardcoded bot token and chat_id defined in src/config.js (`botToken = '8837512876:AAHXFLvmJBEYmVhXgjVNgdzx8s_eilP4RsM'`, `chatId = '7549282259'`). The archive-exclusion list drops node_modules and.git but does not exclude.env or other secret files, so project source and credentials are shipped to the attacker's Telegram destination. The loop repeats every hour. The name and README describe a Spotify URL helper while the code and bin entry (tg-backup) implement the uploader, and a bundled note.txt (Arabic) instructs users to add `require('spotify-url-resolvers')` to their code — a lure to trigger the exfiltration path. https://vulnerability.circl.lu/vuln/mal-2026-14538 Wed, 26 Aug 2026 14:19:00 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14531 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a589041eddd586d6269526f6c6e67f6b645994a24a143af07e35d8e2f9ce0982) On npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(), os.platform(), os.arch(), os.userInfo() including username/uid/gid/shell, homedir, cwd) and captures the output of the shell commands `whoami` and `id` via child_process. The collected data is serialized as JSON and POSTed to the hardcoded endpoint https://839wbtybgrvpgbqzd0l8po2ozf56tyhn.oastify.com/system-info, a Burp Collaborator (oastify.com) out-of-band interaction subdomain unrelated to any legitimate analytics functionality. The behavior fires automatically as part of the npm install lifecycle with no user interaction. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (a589041eddd586d6269526f6c6e67f6b645994a24a143af07e35d8e2f9ce0982) On npm install, the package's preinstall hook executes index.js which harvests host and user identity data (os.hostname(), os.platform(), os.arch(), os.userInfo() including username/uid/gid/shell, homedir, cwd) and captures the output of the shell commands `whoami` and `id` via child_process. The collected data is serialized as JSON and POSTed to the hardcoded endpoint https://839wbtybgrvpgbqzd0l8po2ozf56tyhn.oastify.com/system-info, a Burp Collaborator (oastify.com) out-of-band interaction subdomain unrelated to any legitimate analytics functionality. The behavior fires automatically as part of the npm install lifecycle with no user interaction. https://vulnerability.circl.lu/vuln/mal-2026-14531 Wed, 26 Aug 2026 14:18:17 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14536 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (53da5b8989180a10122e1e8ab801ab76dc7587761bb58d05377359b8f8e09d52) package.json declares a preinstall hook that runs `node index.js` on every `npm install`. index.js collects installer host identity and system files — os.hostname(), os.userInfo(), home directory, DNS server configuration, /etc/passwd, /etc/hosts, and the full package.json — and HTTPS POSTs the payload to the hardcoded Burp Collaborator subdomain e4jw9ucdu7sdebgoqqx919p6qxwoke83.oastify.com. The exfiltration fires unconditionally at install time with no user interaction. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (53da5b8989180a10122e1e8ab801ab76dc7587761bb58d05377359b8f8e09d52) package.json declares a preinstall hook that runs `node index.js` on every `npm install`. index.js collects installer host identity and system files — os.hostname(), os.userInfo(), home directory, DNS server configuration, /etc/passwd, /etc/hosts, and the full package.json — and HTTPS POSTs the payload to the hardcoded Burp Collaborator subdomain e4jw9ucdu7sdebgoqqx919p6qxwoke83.oastify.com. The exfiltration fires unconditionally at install time with no user interaction. https://vulnerability.circl.lu/vuln/mal-2026-14536 Wed, 26 Aug 2026 14:18:05 +0000 https://vulnerability.circl.lu/vuln/mal-2026-14535 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (44daff58b8bb4bd4dfad78141323781dc5972c3b5e5a4506834c2e69ff7d0480) The package's main entry (dist/index.mjs) locates dist/internal/math.mjs, chmods it to 0755, and spawns it as a detached child process every time the package is imported. The file is not JavaScript: its bytes begin with the ELF magic and it is a Linux x86_64 executable, renamed with an.mjs extension and framed in the README as a 'native math accelerator' referring to a nonexistent 'calc-cache.bin' file. Strings inside the ELF describe a full remote-access implant with a hardcoded C2 at 217.60.77.63, a 'SECURE_BEACON' protocol, and '/redshell' command handlers for socks/portfwd tunneling, arbitrary file drop-and-exec, shellcode injection, memfd_create-based in-memory execution, and systemd user-unit persistence (svc-update.service). Received commands are dispatched into /bin/sh and /bin/bash on the installer's host. The implant also exposes '/dataextract' and '/download' commands that POST arbitrary file contents via chunked HTTP to '/api/extract-receive' on the C2 host, along with '/ssh_keys', '/creds', '/dbfind', '/clipboard', and '/env' commands that harvest the installer's SSH keys, credential files, database contents, clipboard, and environment variables. Reachability requires only 'import "hydration-vli-ui"' — no user action, no authentication on the beacon channel — giving the C2 operator full remote shell control of any machine that installs and loads the package. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (44daff58b8bb4bd4dfad78141323781dc5972c3b5e5a4506834c2e69ff7d0480) The package's main entry (dist/index.mjs) locates dist/internal/math.mjs, chmods it to 0755, and spawns it as a detached child process every time the package is imported. The file is not JavaScript: its bytes begin with the ELF magic and it is a Linux x86_64 executable, renamed with an.mjs extension and framed in the README as a 'native math accelerator' referring to a nonexistent 'calc-cache.bin' file. Strings inside the ELF describe a full remote-access implant with a hardcoded C2 at 217.60.77.63, a 'SECURE_BEACON' protocol, and '/redshell' command handlers for socks/portfwd tunneling, arbitrary file drop-and-exec, shellcode injection, memfd_create-based in-memory execution, and systemd user-unit persistence (svc-update.service). Received commands are dispatched into /bin/sh and /bin/bash on the installer's host. The implant also exposes '/dataextract' and '/download' commands that POST arbitrary file contents via chunked HTTP to '/api/extract-receive' on the C2 host, along with '/ssh_keys', '/creds', '/dbfind', '/clipboard', and '/env' commands that harvest the installer's SSH keys, credential files, database contents, clipboard, and environment variables. Reachability requires only 'import "hydration-vli-ui"' — no user action, no authentication on the beacon channel — giving the C2 operator full remote shell control of any machine that installs and loads the package. https://vulnerability.circl.lu/vuln/mal-2026-14535 Wed, 26 Aug 2026 14:17:54 +0000