The dbt-adapter package on PyPI contains malicious code that exfiltrates basic information such as the host's IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. The package serves no legitimate purpose beyond this data exfiltration.
The synapse-hub npm package version 3.1.0 contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an external attacker. Immediate removal of the package and rotation of all secrets and keys stored on the affected system are strongly advised, although removal may not fully eliminate the threat due to possible persistent malicious software.
The PyPI package 'rcp-ndcg' version 9999.0.0 has been identified as malicious by the OpenSSF Package Analysis project. It is flagged due to its communication with a domain associated with malicious activity. No further technical details or CVSS score are provided.
Hackers linked to Russia's Foreign Intelligence Service exploited previously patched vulnerabilities in iOS and Android devices to target visitors of multiple websites, including a site celebrating American independence and a luxury UK hotel near sensitive government institutions. The attackers used JavaScript injection, proxy domains, and a compromised Ukrainian web analytics service to deliver three zero-click exploit chains, including the DarkSword iOS exploit kit. The attacks aimed to steal browser cookies, Wi-Fi passwords, and device data from diplomatic and high-profile targets related to Ukraine.
The strands-aidr package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The npm package @secauditb20y/sec-test-b1 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have established persistent control.
The npm package '@secaudita10x/sec-test-a1' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the severity of the compromise, complete remediation may require rotating all secrets and keys from a different, uncompromised machine.
The dogmans-afterglow npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The npm package 'thththtbhthhth' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee the elimination of all malicious software introduced by it.
The npm package 'nannnnnnnnn' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but due to potential full control by an attacker, removal alone may not eliminate all malicious components.
The npm package 'heheheshsds' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The doghack-afterglow npm package contains malicious code that compromises any computer on which it is installed or running. This compromise can lead to full control by an outside entity, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised computer is strongly advised.
The npm package @saidddddddddd/ggsgg contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The nminer package version 3.0.0 on npm contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by its installation.
The npm package @pubngo-stack/help-browser version 12.0.23-alpha.3 contains malicious code that fully compromises any computer on which it is installed or run. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets and keys from a different, secure computer is strongly advised. However, removal of the package alone may not eliminate all malicious software introduced by the compromise.
The npm package @cdmbase/wiki-browser version 12.0.18-alpha.53 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have gained full control of the system.
The npm package @adminide-stack/yantra-help-browser version 12.0.194 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control over the system.
The npm package @adminide-stack/forms-core version 5.1.9-alpha.3 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a separate, uncompromised machine due to the possibility of persistent malicious software.
The npm package 'cdeops' version 13.5.31 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package @adminide-stack/user-activity-browser versions 1.1.3-alpha.114 and 0.0.16-129 contains malicious code. Any system with this package installed or running is considered fully compromised, potentially allowing an attacker full control over the computer. Immediate removal of the package and rotation of all secrets and keys stored on the affected system are strongly advised.
