https://db.gcve.eu/rss/recent/ossf_malicious_packages/10 2026-08-09T17:51:06.411553+00:00 Vulnerability-Lookup info@gcve.eu python-feedgen Contains only the most 10 recent entries. https://db.gcve.eu/vuln/mal-2026-13666 2026-08-09T13:09:20+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (d669fdf7584f17d952cec3ed432bdb8f07672b43c3bc42ae68aa2d042d51481b) Package appears to abuse PyPI for a CTF-like exercise. It can collect up to all environment variables. The package does not exfiltrate them on its own, suggesting there is another external trigger for that. Originally detected by Aikido. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: 2026-08-cubesat-upstream-driver Reasons (based on the campaign): - dependency-confusion - other

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (d669fdf7584f17d952cec3ed432bdb8f07672b43c3bc42ae68aa2d042d51481b) Package appears to abuse PyPI for a CTF-like exercise. It can collect up to all environment variables. The package does not exfiltrate them on its own, suggesting there is another external trigger for that. Originally detected by Aikido. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: 2026-08-cubesat-upstream-driver Reasons (based on the campaign): - dependency-confusion - other

2026-08-09T13:09:20+00:00 https://db.gcve.eu/vuln/mal-2026-13665 2026-08-08T20:02:26+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (3dada3cec22fb43bb528b8f4f7173bb346b25e373eaeb719af2df48698119240) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (3dada3cec22fb43bb528b8f4f7173bb346b25e373eaeb719af2df48698119240) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation.

2026-08-08T20:02:26+00:00 https://db.gcve.eu/vuln/mal-2026-13629 2026-08-08T00:52:09+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763) Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor (hyphen removed). The npm postinstall hook, implemented in scripts/postinstall.js, hides all string literals behind a hex-escaped string-array decoder (_0x5a2f / _0xf). On Windows (win32), the decoded logic downloads a zip archive from the anonymous file host https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell Expand-Archive to a temporary directory, walks the extracted tree, and spawns any.exe file it finds detached with windowsHide. index.js is a minimal stub; the package's advertised Anchor framework functionality is not present, and the postinstall dropper is the sole meaningful behavior. The delivery vector is name confusion with the widely used @coral-xyz/anchor package.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763) Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor (hyphen removed). The npm postinstall hook, implemented in scripts/postinstall.js, hides all string literals behind a hex-escaped string-array decoder (_0x5a2f / _0xf). On Windows (win32), the decoded logic downloads a zip archive from the anonymous file host https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell Expand-Archive to a temporary directory, walks the extracted tree, and spawns any.exe file it finds detached with windowsHide. index.js is a minimal stub; the package's advertised Anchor framework functionality is not present, and the postinstall dropper is the sole meaningful behavior. The delivery vector is name confusion with the widely used @coral-xyz/anchor package.

2026-08-08T00:52:09+00:00 https://db.gcve.eu/vuln/mal-2026-13664 2026-08-08T00:52:01+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6) titan-exchange-shared-permissions@99.9.9 is a dependency-confusion reconnaissance package. package.json declares a postinstall script (`node index.js`) that runs automatically on `npm install`; index.js collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), current working directory, and non-internal IPv4 address (from os.networkInterfaces()) and POSTs them as JSON via https.request to the hardcoded collector https://webhook.site/452b7e38-183d-4652-847d-0f2fa05b9389. The package name is styled to resemble a private internal scope, is published at version 99.9.9, and ships with empty description/author/license and no other functionality — the canonical namesquat/dependency-confusion probe shape used to identify build systems that resolve a private name to the public registry.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6) titan-exchange-shared-permissions@99.9.9 is a dependency-confusion reconnaissance package. package.json declares a postinstall script (`node index.js`) that runs automatically on `npm install`; index.js collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), current working directory, and non-internal IPv4 address (from os.networkInterfaces()) and POSTs them as JSON via https.request to the hardcoded collector https://webhook.site/452b7e38-183d-4652-847d-0f2fa05b9389. The package name is styled to resemble a private internal scope, is published at version 99.9.9, and ships with empty description/author/license and no other functionality — the canonical namesquat/dependency-confusion probe shape used to identify build systems that resolve a private name to the public registry.

2026-08-08T00:52:01+00:00 https://db.gcve.eu/vuln/mal-2026-13633 2026-08-08T01:38:10.319764+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5) On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) that performs an HTTP GET against a hardcoded jsonbin.io endpoint (https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed) and executes the returned string as JavaScript with full Node privileges. utils.js passes the fetched record.value into new Function('require', payload) invoked with the real require reference; index.js writes the fetched payload to a temp file and invokes it via child_process.fork. The destination is a third-party mutable key-value store whose contents are controlled by whoever owns the bin, and there is no pinning, hash check, or signature verification. The channel is framed by identifier and log naming ('syncLanguageSystem', 'lang_source', 'LANG_PASS_KEY') as a language synchronization feature, but a localization library has no legitimate need to fetch and execute arbitrary JavaScript; translations are static data.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5) On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) that performs an HTTP GET against a hardcoded jsonbin.io endpoint (https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed) and executes the returned string as JavaScript with full Node privileges. utils.js passes the fetched record.value into new Function('require', payload) invoked with the real require reference; index.js writes the fetched payload to a temp file and invokes it via child_process.fork. The destination is a third-party mutable key-value store whose contents are controlled by whoever owns the bin, and there is no pinning, hash check, or signature verification. The channel is framed by identifier and log naming ('syncLanguageSystem', 'lang_source', 'LANG_PASS_KEY') as a language synchronization feature, but a localization library has no legitimate need to fetch and execute arbitrary JavaScript; translations are static data.

2026-08-08T00:51:44+00:00 https://db.gcve.eu/vuln/mal-2026-13631 2026-08-08T00:55:08+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701) On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and executes the returned `record.value` field as JavaScript, both by writing it to a temp file and running it via `child_process.fork` and via `new Function('require', payload)(require)` in a separate module-load IIFE that pulls https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed. Both sinks pass the Node `require` to the constructed function, granting full Node capabilities to whatever the mutable jsonbin.io bin currently serves. Function and variable names (`syncLanguageSystem`, `LANG_SOURCE`, `lang_pass_key`) frame the fetch-and-exec as a localization-sync feature, but the advertised purpose of the package has no need to evaluate remote bytes. The jsonbin.io bins are attacker-mutable, so the payload delivered to any installer is arbitrary and can change at any moment.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701) On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and executes the returned `record.value` field as JavaScript, both by writing it to a temp file and running it via `child_process.fork` and via `new Function('require', payload)(require)` in a separate module-load IIFE that pulls https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed. Both sinks pass the Node `require` to the constructed function, granting full Node capabilities to whatever the mutable jsonbin.io bin currently serves. Function and variable names (`syncLanguageSystem`, `LANG_SOURCE`, `lang_pass_key`) frame the fetch-and-exec as a localization-sync feature, but the advertised purpose of the package has no need to evaluate remote bytes. The jsonbin.io bins are attacker-mutable, so the payload delivered to any installer is arbitrary and can change at any moment.

2026-08-08T00:51:34+00:00 https://db.gcve.eu/vuln/mal-2026-13630 2026-08-08T00:47:57+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126) scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126) scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching.

2026-08-08T00:47:57+00:00 https://db.gcve.eu/vuln/mal-2026-13632 2026-08-08T00:47:48+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4) On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x86_64 binary dist/internal/calc-math.dat as a detached background process. The binary is a RedShell-style remote-access implant: it beacons to hardcoded C2 217.60.77.63, executes /bin/sh commands, drops and runs additional ELFs and shellcode fetched from the C2, offers SOCKS5 proxying and TCP port forwarding, installs systemd --user persistence (svc-update.service), and exfiltrates files via POST /api/extract-receive. Implant commands /ssh_keys, /creds, /dbfind, /clipboard, /env, and /dataextract harvest installer-side secrets (SSH private keys, stored credentials, clipboard, environment) and upload them to the same C2 through a chunked BIGEXTRACT upload routine. Package name, README, and inline comments describe the ELF as a 'native math accelerator' for calendar/streak math, but the pure-JS daymath.mjs never invokes the binary; the shipped SHA-256 'integrity check' (4537b118...3466) pins this specific implant, so it functions as anti-tamper for the payload rather than a security control.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (80727943437a7e22116b369c010fc965c4854a0c58a053504c4bc55555e90dd4) On import, dist/index.mjs chmods 0755 and spawns the bundled Linux x86_64 binary dist/internal/calc-math.dat as a detached background process. The binary is a RedShell-style remote-access implant: it beacons to hardcoded C2 217.60.77.63, executes /bin/sh commands, drops and runs additional ELFs and shellcode fetched from the C2, offers SOCKS5 proxying and TCP port forwarding, installs systemd --user persistence (svc-update.service), and exfiltrates files via POST /api/extract-receive. Implant commands /ssh_keys, /creds, /dbfind, /clipboard, /env, and /dataextract harvest installer-side secrets (SSH private keys, stored credentials, clipboard, environment) and upload them to the same C2 through a chunked BIGEXTRACT upload routine. Package name, README, and inline comments describe the ELF as a 'native math accelerator' for calendar/streak math, but the pure-JS daymath.mjs never invokes the binary; the shipped SHA-256 'integrity check' (4537b118...3466) pins this specific implant, so it functions as anti-tamper for the payload rather than a security control.

2026-08-08T00:47:48+00:00 https://db.gcve.eu/vuln/mal-2026-13640 2026-08-08T00:47:40+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6f3461050b5714edca455c0fd78e979cd5efbdfeeb375016aeb4fe4523f47682) On require(), index.js loads _adapter.js which selects a platform-specific payload (linux x64/arm64, darwin, win32) and fetches it from string-split-obfuscated hosts including oob-worker.cf1-01-adf.workers.dev and sdk.dl.wel1.ru, with a DNS-TXT fallback over *.dl.wel1.ru. The retrieved bytes are written to a hidden temp file, chmodded to 0755 on POSIX, and executed detached via spawn("/bin/sh", ["-c", filePath + " &"]) or spawn("cmd",...) on Windows. A second parallel dropper exists in the package's main module lib/telemetry.js under an 'analytics SDK' cover story, reproducing the base64/DNS-TXT decode, chmod 0755, and /bin/sh execution path. Hostnames and the string 'child_process' are assembled at runtime from split arrays (e.g. require("child_" + "process"), ['sdk.dl.wel1.ru'].join(""), ['ext.dl.we','l1.','ru'].join("")) to evade static detection. No signature or hash verification is performed; destinations are not the declared publisher's infrastructure. The package name mimics an internal-looking scope (sme-rko-finance-front-operations-notifications-impl) consistent with a dependency-confusion lure.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (6f3461050b5714edca455c0fd78e979cd5efbdfeeb375016aeb4fe4523f47682) On require(), index.js loads _adapter.js which selects a platform-specific payload (linux x64/arm64, darwin, win32) and fetches it from string-split-obfuscated hosts including oob-worker.cf1-01-adf.workers.dev and sdk.dl.wel1.ru, with a DNS-TXT fallback over *.dl.wel1.ru. The retrieved bytes are written to a hidden temp file, chmodded to 0755 on POSIX, and executed detached via spawn("/bin/sh", ["-c", filePath + " &"]) or spawn("cmd",...) on Windows. A second parallel dropper exists in the package's main module lib/telemetry.js under an 'analytics SDK' cover story, reproducing the base64/DNS-TXT decode, chmod 0755, and /bin/sh execution path. Hostnames and the string 'child_process' are assembled at runtime from split arrays (e.g. require("child_" + "process"), ['sdk.dl.wel1.ru'].join(""), ['ext.dl.we','l1.','ru'].join("")) to evade static detection. No signature or hash verification is performed; destinations are not the declared publisher's infrastructure. The package name mimics an internal-looking scope (sme-rko-finance-front-operations-notifications-impl) consistent with a dependency-confusion lure.

2026-08-08T00:47:40+00:00 https://db.gcve.eu/vuln/mal-2026-13649 2026-08-08T00:47:27+00:00 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa) On require, index.js loads _platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf) with a DNS TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or Windows Temp under disguised names (e.g.,.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string arrays to defeat static analysis. The package's stated purpose (finance/tax operations frontend) has no legitimate need to fetch and execute an opaque native binary from non-publisher infrastructure.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (ede42a446ab3685943424af5a5411fb93bf5961c83ccf6ce02b35b8d835c60aa) On require, index.js loads _platform.js and lib/telemetry.js, which download a platform-specific binary from obfuscated Cloudflare Workers hosts (oob-worker.cf100-416.workers.dev, cf103-070, cf102-baf) with a DNS TXT-record fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /tmp or Windows Temp under disguised names (e.g.,.cache_<hex>, dotnet_diag_<hex>.exe), chmod'd to 0755, and spawned detached via /bin/sh -c or cmd.exe /c start /b. Hostnames and sensitive API names (child_process, chmodSync) are reassembled at runtime from split string arrays to defeat static analysis. The package's stated purpose (finance/tax operations frontend) has no legitimate need to fetch and execute an opaque native binary from non-publisher infrastructure.

2026-08-08T00:47:27+00:00