Threats Tagged 'malicious-package'

The npm package @idkruan-10/dpd-depconf-probe contains malicious code that fully compromises any computer on which it is installed or running. The compromise allows an attacker to gain full control over the affected system. Immediate rotation of all secrets and keys stored on the compromised machine is necessary, using a different, clean computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.

The npm package 'op-ts-server-core' contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious software introduced by it.

The npm package 'service-home' contains malicious code that fully compromises any computer on which it is installed or running. The presence of this package indicates a complete security breach, necessitating immediate rotation of all secrets and keys from a separate, uncompromised system. Simply removing the package does not guarantee elimination of all malicious software introduced by it.

The npm package @aircanada/navigation-handler contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a separate, trusted device. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.

The npm package '@aircanada/components' contains malicious code that compromises any computer on which it is installed or executed. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, secure machine. Simply removing the package does not guarantee removal of all malicious artifacts or backdoors, as the attacker may have gained full control of the system.

The npm package @aircanada/core contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software introduced by the package, as the attacker may have gained full control of the system.

The npm package '@cp-shared-14/frontend-ui' version 6.3.4 has been identified as malicious. It communicates with domains linked to malicious activity and executes commands associated with harmful behavior. There is no CVSS score available for this threat. No official patch or remediation guidance is provided in the available data.

The cv-train package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.

The PyPI package 'telegram-helper' versions 0.1.1 and 0.1.2 contain malicious code that starts a Telegram bot to exfiltrate sensitive session files and browser cookies. This package acts as a remote access trojan (RAT) with capabilities to execute remote commands and steal browser data. It is designed to target victims via Telegram and uses a Telegram bot for command and control and data exfiltration.

The npm package @jacksher/install-exec-poc contains malicious code that executes during installation. It performs DNS lookups and HTTPS requests to an attacker-controlled domain, leaking the installer's public IP and resolver metadata. It also uses execSync to run curl commands, establishing a shell-to-network primitive on the host. This behavior occurs unconditionally on install, compromising any system that installs the package. The package is labeled as a proof-of-concept but poses a real threat to consumers. Removal of the package does not guarantee full remediation due to potential persistent compromise.