Threat Intelligence Database

The PyPI package `tsshare` is malicious. It impersonates the popular Chinese market-data library `tushare` — its docstrings advertise compatibility with `Tushare pro_bar` and it ships `MyShareClient`/`MyShareError` aliases. `tsshare/client.py` conceals its default API endpoint by base64-decoding it at runtime: in 1.0.5–1.0.18 the value decodes to the hardcoded raw IP `https://47.112.191.75` (Alibaba Cloud, China), and in 1.0.19 it rotates to the domain `https://fszzw56.com`. On use, the client builds a persistent cross-platform hardware fingerprint (Windows disk-drive serial via `Win32_DiskDrive`, macOS `Hardware UUID` via `system_profiler`, Linux `/etc/machine-id`) and routes the request — carrying the user's Tushare `auth_code` token — to that hidden endpoint, so the operator receives the paid API token together with a stable machine identifier. There is no install-time hook; exfiltration occurs on API use. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (539c8fdb69887b093801655215f1857f53abb20e6dc763198c543def86c39387) The package presents itself as a drop-in replacement for Tushare's pro_api, but every method call is dispatched through a query() that POSTs to a hardcoded default backend at https://47.112.191.75/api/v1/proxy rather than to tushare.pro. The destination URL is stored base64-encoded (_E = b"aHR0cHM6Ly80Ny4xMTIuMTkxLjc1") and decoded at runtime by _default_base_url, and the destination is a bare IP unrelated to the credential's issuer. set_token() stores the caller's Tushare auth_code, and every subsequent proxied call includes {'auth_code': self.auth_code,...} in the POST body to that endpoint, so the paid third-party credential leaves the trust boundary it was issued for and can be logged or replayed by the operator of 47.112.191.75. The client also collects a persistent hardware fingerprint on first use — PowerShell Win32_Processor ProcessorId and Win32_DiskDrive SerialNumber on Windows, system_profiler Hardware UUID on macOS, /etc/machine-id on Linux — SHA-256 hashes it, caches it under ~/.tsshare/device_id.json, and attaches it as meta.device_id to every request, giving the backend operator a stable per-machine identifier unnecessary for the advertised proxy function. TLS certificate verification on the requests.Session is disabled by default (session.verify defaults to false via TSSHARE_SSL_VERIFY/MYSHARE_SSL_VERIFY) and urllib3 InsecureRequestWarning is silenced, so the auth_code and hardware ID are transmitted to the bare-IP HTTPS endpoint without cert validation.

CVE-2026-81704 is a high-severity vulnerability in jahlives' openssl_encrypt versions before 1.4.9. It involves the use of a weak key derivation method in the D-Bus CryptoService.EncryptFile handler, which uses unstretched SHA-256 instead of the more secure Argon2id. This weakness allows attackers to perform offline password guessing attacks significantly faster than intended, reducing the computational effort required by approximately six to seven orders of magnitude.

CVE-2026-81689 is a high-severity vulnerability in jahlives' openssl_encrypt component prior to version 1.4.9. The flaw involves deriving the remote-pepper wrap key using unsalted HKDF-SHA256 or bare SHA-256 of the password, resulting in identical keys across all users and files. This weakness enables attackers with access to wrapped pepper blobs to precompute a dictionary table and perform offline password guessing attacks at hardware speed, potentially recovering user passwords.

CVE-2026-81688 is a high-severity vulnerability in jahlives' openssl_encrypt component prior to version 1.4.9. The issue involves storing an unkeyed SHA-256 hash of the plaintext in the cleartext file header metadata. This allows attackers to read the hash without needing the password, enabling offline confirmation of guessed plaintexts or fingerprinting identical plaintexts across different encrypted files.

The IronLantern tool is a remediation and recovery utility developed to address infections by the Yogi malware, a Python 3.9/PyInstaller-based implant targeting Windows systems. Yogi malware establishes persistence through multiple mechanisms including registry Run keys and startup folder entries, creates randomized copies in user application data directories with hidden attributes, and employs a repeating-XOR ransomware encryption scheme with deterministic SHA-256-derived keys. The malware communicates with command and control servers via JSON over HTTP(S), with identified endpoints at go-ns.org.ua. IronLantern detects the exact malware sample, cleans persistence mechanisms, terminates live processes, quarantines or deletes malicious files, and recovers files encrypted by the XOR scheme. The tool and full reverse engineering report are publicly available on GitHub. No official vendor advisory or patch exists, and no known exploits in the wild have been reported.

PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs to access a PostgreSQL database. Security Fix(es): * jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication (CVE-2026-42198) For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

The npm package sui-graphql-rpc version 1.0.1 contains malicious code that reads the installer's ~/.gitconfig to extract the developer's email and name. It uses a SHA-256 hash of this identity as an AES-256-GCM key to decrypt embedded ciphertext blobs. If decryption succeeds, the resulting JavaScript code is executed dynamically, allowing targeted arbitrary code execution on developer workstations. This behavior is intentionally designed to evade detection by restricting execution to a hardcoded victim allowlist and skipping execution in CI environments. The package's advertised functionality does not require reading ~/.gitconfig, indicating the read is solely for malicious gating of code execution.

The Ingenic T31 SoC boot ROM has a vulnerability in its flash-boot verification process where only a single 32-bit word of the RSA signature is compared against a single 32-bit word of the SHA-256 payload digest. This incomplete verification allows an attacker with physical write access to the boot media to forge modified Secondary Program Loader (SPL) images that pass secure boot checks without the OEM signing key. The forgery attempt has a high success probability of about 2/3. This vulnerability has been validated through reverse engineering, software emulation, and hardware testing on a Wyze Video Doorbell v2 (T31X).

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation. Attackers on the agent-to-agent path or malicious peers can supply substituted content with forged CRC32 corrections that passes per-piece checks, poisoning the cache with attacker-chosen container image layers or manifests that are re-seeded and executed by other hosts.

CVE-2026-74871 is a vulnerability in jahlives' openssl_encrypt prior to version 1.4.6. It involves a key derivation flaw in the sequential XOR composition mode where the last stage cancels out during key generation. This flaw allows attackers to bypass memory-hard key derivation when configured with a single KDF and no prior hashing stage, enabling offline password cracking at the speed of SHA-256 rather than the intended KDF cost.