https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sun, 09 Aug 2026 09:31:48 +0000 https://db.gcve.eu/vuln/mal-2026-13665 --- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (3dada3cec22fb43bb528b8f4f7173bb346b25e373eaeb719af2df48698119240) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. --- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (3dada3cec22fb43bb528b8f4f7173bb346b25e373eaeb719af2df48698119240) Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities. Campaign: GENERIC-standard-pypi-install-pentest Reasons (based on the campaign): - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk. - The package overrides the install command in setup.py to execute malicious code during installation. https://db.gcve.eu/vuln/mal-2026-13665 Sat, 08 Aug 2026 20:02:26 +0000 https://db.gcve.eu/vuln/mal-2026-13633 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5) On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) that performs an HTTP GET against a hardcoded jsonbin.io endpoint (https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed) and executes the returned string as JavaScript with full Node privileges. utils.js passes the fetched record.value into new Function('require', payload) invoked with the real require reference; index.js writes the fetched payload to a temp file and invokes it via child_process.fork. The destination is a third-party mutable key-value store whose contents are controlled by whoever owns the bin, and there is no pinning, hash check, or signature verification. The channel is framed by identifier and log naming ('syncLanguageSystem', 'lang_source', 'LANG_PASS_KEY') as a language synchronization feature, but a localization library has no legitimate need to fetch and execute arbitrary JavaScript; translations are static data. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4be23667d11e7ef3357641973b9188175c2068bd2b580a5628773bcdf03533a5) On server-side require of modern-localization, the package's main entry runs a top-level async IIFE (syncLanguageSystem) that performs an HTTP GET against a hardcoded jsonbin.io endpoint (https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed) and executes the returned string as JavaScript with full Node privileges. utils.js passes the fetched record.value into new Function('require', payload) invoked with the real require reference; index.js writes the fetched payload to a temp file and invokes it via child_process.fork. The destination is a third-party mutable key-value store whose contents are controlled by whoever owns the bin, and there is no pinning, hash check, or signature verification. The channel is framed by identifier and log naming ('syncLanguageSystem', 'lang_source', 'LANG_PASS_KEY') as a language synchronization feature, but a localization library has no legitimate need to fetch and execute arbitrary JavaScript; translations are static data. https://db.gcve.eu/vuln/mal-2026-13633 Sat, 08 Aug 2026 00:51:44 +0000 https://db.gcve.eu/vuln/mal-2026-13402 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced) lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode(...) arrays that decode to https://fiora.nixel.my.id/. The host is assembled from decimal char codes rather than appearing as a plain string literal, which is a deliberate obfuscation pattern used to hide exfiltration or covert-callback endpoints from casual review. The file is part of the WhatsApp/Baileys socket message-send path, where such hidden destinations are consistent with covert use of the caller's session (exfiltrating message/session data or performing actions with the installer's authenticated identity) rather than any documented library behavior. The package is a fork of a legitimate messaging library and no documented purpose justifies a char-code-hidden third-party host inside the message-send pipeline. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (2fc5aa3a28b53c63f65ab724aebe774c23f737686f5db7411bfa871fa4f7eced) lib/Socket/messages-send.js contains network destinations reconstructed via String.fromCharCode(...) arrays that decode to https://fiora.nixel.my.id/. The host is assembled from decimal char codes rather than appearing as a plain string literal, which is a deliberate obfuscation pattern used to hide exfiltration or covert-callback endpoints from casual review. The file is part of the WhatsApp/Baileys socket message-send path, where such hidden destinations are consistent with covert use of the caller's session (exfiltrating message/session data or performing actions with the installer's authenticated identity) rather than any documented library behavior. The package is a fork of a legitimate messaging library and no documented purpose justifies a char-code-hidden third-party host inside the message-send pipeline. https://db.gcve.eu/vuln/mal-2026-13402 Thu, 06 Aug 2026 12:24:26 +0000 https://db.gcve.eu/vuln/mal-2026-13631 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701) On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and executes the returned `record.value` field as JavaScript, both by writing it to a temp file and running it via `child_process.fork` and via `new Function('require', payload)(require)` in a separate module-load IIFE that pulls https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed. Both sinks pass the Node `require` to the constructed function, granting full Node capabilities to whatever the mutable jsonbin.io bin currently serves. Function and variable names (`syncLanguageSystem`, `LANG_SOURCE`, `lang_pass_key`) frame the fetch-and-exec as a localization-sync feature, but the advertised purpose of the package has no need to evaluate remote bytes. The jsonbin.io bins are attacker-mutable, so the payload delivered to any installer is arbitrary and can change at any moment. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (72446c1307e81047c64d819d3485fa77062061c8c9d4d0b38b42e311137c8701) On require of the package's main entry, a top-level `if (isServer) syncLanguageSystem()` fetches a JSON payload from https://api.jsonbin.io/v3/b/6a764665da38895dfec7cd5d and executes the returned `record.value` field as JavaScript, both by writing it to a temp file and running it via `child_process.fork` and via `new Function('require', payload)(require)` in a separate module-load IIFE that pulls https://api.jsonbin.io/v3/b/6a718a58da38895dfeb6e2ed. Both sinks pass the Node `require` to the constructed function, granting full Node capabilities to whatever the mutable jsonbin.io bin currently serves. Function and variable names (`syncLanguageSystem`, `LANG_SOURCE`, `lang_pass_key`) frame the fetch-and-exec as a localization-sync feature, but the advertised purpose of the package has no need to evaluate remote bytes. The jsonbin.io bins are attacker-mutable, so the payload delivered to any installer is arbitrary and can change at any moment. https://db.gcve.eu/vuln/mal-2026-13631 Sat, 08 Aug 2026 00:51:34 +0000 https://db.gcve.eu/vuln/mal-2026-13516 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734) index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms (3 days) that calls https.get against https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json. The gist is hosted on a GitHub account (opensource-crypto) unrelated to the declared package publisher (danird9). If the fetched JSON contains a `c2` field, the value is persisted to ~/.forge-gas-diff.remote for later use. A separate getInstallId() routine writes a per-host UUID to ~/.forge-gas-diff, providing a stable install fingerprint. None of this behavior — outbound network fetch, install-ID generation, remote-config persistence, or a field literally named `c2` — has any relationship to the advertised gas-diff functionality and is not documented in the package. The gist is author-mutable, so the content delivered to installers can be changed at any time without republishing the package; the 3-day delay places the fetch well outside typical install-time sandboxing windows. The mechanism is the staging half of a remote-config-driven dropper: a hidden update channel keyed to attacker-editable content on a third-party host, with persistence to a well-known filesystem path on the installer's machine. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (4b1f6143f5a7c6106ab4ba0a21a6adaf9020e332835b1e528de6f36b64537734) index.js is advertised as a Foundry gas-report diff utility but on module load / CLI run schedules a setTimeout of 259,200,000 ms (3 days) that calls https.get against https://gist.githubusercontent.com/opensource-crypto/3946ef88aa057c9d10f1a7d80391d164/raw/default.json. The gist is hosted on a GitHub account (opensource-crypto) unrelated to the declared package publisher (danird9). If the fetched JSON contains a `c2` field, the value is persisted to ~/.forge-gas-diff.remote for later use. A separate getInstallId() routine writes a per-host UUID to ~/.forge-gas-diff, providing a stable install fingerprint. None of this behavior — outbound network fetch, install-ID generation, remote-config persistence, or a field literally named `c2` — has any relationship to the advertised gas-diff functionality and is not documented in the package. The gist is author-mutable, so the content delivered to installers can be changed at any time without republishing the package; the 3-day delay places the fetch well outside typical install-time sandboxing windows. The mechanism is the staging half of a remote-config-driven dropper: a hidden update channel keyed to attacker-editable content on a third-party host, with persistence to a well-known filesystem path on the installer's machine. https://db.gcve.eu/vuln/mal-2026-13516 Fri, 07 Aug 2026 12:09:35 +0000 https://db.gcve.eu/vuln/mal-2026-13400 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1) agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-session.lakshman111.workers.dev) and act on them locally. The `tunnel_run_command` tool takes `proposal.payload.command` from the remote snapshot and runs it via `spawn(command, { cwd: workdir, shell: true, env: process.env })`, giving whoever controls the remote session arbitrary shell execution on the installer's machine with the installer's privileges and full environment. The `tunnel_apply_patch` tool takes a unified diff from `proposal.payload.patch` and writes it into files under the resolved workdir; although a path-escape check confines writes to that workdir, remote-supplied edits to project files (build scripts, git hooks, source code) yield persistent code-execution as soon as the project is next built, tested, or run. Both tools are gated only by approval flags (`proposal.status`, `require_approval`) that live on the same remote worker, so a hostile or compromised server can toggle its own gate. The `agenttunnels install` CLI additionally merges an `agenttunnels` entry into `~/.cursor/mcp.json` by default, wiring this bridge into every Cursor project the user opens and broadening the surface. No npm lifecycle script is declared, so the bridge activates when the user runs the CLI or the MCP client autoloads it, not on `npm install` itself. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (264711675c5edabf4f3d0b1d544ca8bade34057c973ca614c82bca3cf8bdd5a1) agenttunnels ships an MCP bridge whose customer-role tools accept payloads from a remote session worker (agenttunnels-session.lakshman111.workers.dev) and act on them locally. The `tunnel_run_command` tool takes `proposal.payload.command` from the remote snapshot and runs it via `spawn(command, { cwd: workdir, shell: true, env: process.env })`, giving whoever controls the remote session arbitrary shell execution on the installer's machine with the installer's privileges and full environment. The `tunnel_apply_patch` tool takes a unified diff from `proposal.payload.patch` and writes it into files under the resolved workdir; although a path-escape check confines writes to that workdir, remote-supplied edits to project files (build scripts, git hooks, source code) yield persistent code-execution as soon as the project is next built, tested, or run. Both tools are gated only by approval flags (`proposal.status`, `require_approval`) that live on the same remote worker, so a hostile or compromised server can toggle its own gate. The `agenttunnels install` CLI additionally merges an `agenttunnels` entry into `~/.cursor/mcp.json` by default, wiring this bridge into every Cursor project the user opens and broadening the surface. No npm lifecycle script is declared, so the bridge activates when the user runs the CLI or the MCP client autoloads it, not on `npm install` itself. https://db.gcve.eu/vuln/mal-2026-13400 Thu, 06 Aug 2026 13:04:30 +0000 https://db.gcve.eu/vuln/mal-2026-11123 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1) The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under `HKCU\Software\LarkCli\keychain` — refreshes each token, and batch-POSTs `{app_id, app_secret, access_token, refresh_token}` for every profile every 5 minutes to a hardcoded default endpoint `http://47.112.24.153` (plain HTTP, bare IPv4, no TLS). The endpoint constant `DEFAULT_OPENHERMIT_CLOUD_BASE_URL` is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The `reportAllLarkCredentials` code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional `cc-connect` dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) `app_id` + `app_secret` combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (7f6774653f487db8fbb9b40f1c1aba2bf959edffae409445162b0d245a3bedf1) The @yancyyu/agentcli package installs a telemetry worker (dist/telemetry-worker.bundle.mjs) that is started by `agentcli init` / `agentcli usage start` and auto-started via macOS launchd. The worker enumerates every lark-cli (Feishu) profile stored on the host — decrypting macOS Keychain-wrapped AES-256-GCM `.enc` files under `~/Library/Application Support/lark-cli/` and Windows DPAPI-protected values under `HKCU\Software\LarkCli\keychain` — refreshes each token, and batch-POSTs `{app_id, app_secret, access_token, refresh_token}` for every profile every 5 minutes to a hardcoded default endpoint `http://47.112.24.153` (plain HTTP, bare IPv4, no TLS). The endpoint constant `DEFAULT_OPENHERMIT_CLOUD_BASE_URL` is the single default for the credential batch upload and conversation/usage pipelines when no override env var or settings value is present. The enumeration is not limited to AgentCli-created profiles; every lark-cli profile on the machine is harvested. The `reportAllLarkCredentials` code comment states: "enumerate all personal lark-cli profiles, refresh each, then read current credentials [...] batch the complete eligible set to the server." The postinstall step additionally rewrites the optional `cc-connect` dependency's installer to prepend third-party China GitHub mirror hosts (gh-proxy.com, ghproxy.net) in front of upstream release URLs before the cc-connect native binary is downloaded and executed, broadening the trust boundary for that binary. Feishu (Lark) `app_id` + `app_secret` combined with valid access/refresh tokens allow full impersonation of the affected tenant applications; sending them cleartext to a bare IPv4 over HTTP additionally exposes them to any on-path observer. https://db.gcve.eu/vuln/mal-2026-11123 Tue, 28 Jul 2026 13:30:51 +0000 https://db.gcve.eu/vuln/mal-2026-13629 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763) Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor (hyphen removed). The npm postinstall hook, implemented in scripts/postinstall.js, hides all string literals behind a hex-escaped string-array decoder (_0x5a2f / _0xf). On Windows (win32), the decoded logic downloads a zip archive from the anonymous file host https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell Expand-Archive to a temporary directory, walks the extracted tree, and spawns any.exe file it finds detached with windowsHide. index.js is a minimal stub; the package's advertised Anchor framework functionality is not present, and the postinstall dropper is the sole meaningful behavior. The delivery vector is name confusion with the widely used @coral-xyz/anchor package. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (1475ce579e5b1ce9d7597187d091b29b70cbe1a563ed70946517673c29683763) Package @coralxyz/anchor impersonates the legitimate Solana Anchor framework package @coral-xyz/anchor (hyphen removed). The npm postinstall hook, implemented in scripts/postinstall.js, hides all string literals behind a hex-escaped string-array decoder (_0x5a2f / _0xf). On Windows (win32), the decoded logic downloads a zip archive from the anonymous file host https://files.catbox.moe/9bppy2.zip, extracts it via PowerShell Expand-Archive to a temporary directory, walks the extracted tree, and spawns any.exe file it finds detached with windowsHide. index.js is a minimal stub; the package's advertised Anchor framework functionality is not present, and the postinstall dropper is the sole meaningful behavior. The delivery vector is name confusion with the widely used @coral-xyz/anchor package. https://db.gcve.eu/vuln/mal-2026-13629 Sat, 08 Aug 2026 00:52:09 +0000 https://db.gcve.eu/vuln/mal-2026-13664 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6) titan-exchange-shared-permissions@99.9.9 is a dependency-confusion reconnaissance package. package.json declares a postinstall script (`node index.js`) that runs automatically on `npm install`; index.js collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), current working directory, and non-internal IPv4 address (from os.networkInterfaces()) and POSTs them as JSON via https.request to the hardcoded collector https://webhook.site/452b7e38-183d-4652-847d-0f2fa05b9389. The package name is styled to resemble a private internal scope, is published at version 99.9.9, and ships with empty description/author/license and no other functionality — the canonical namesquat/dependency-confusion probe shape used to identify build systems that resolve a private name to the public registry. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (248b317decf11a421474c727d9b8f543330eab17a65b31adf91f4083782025b6) titan-exchange-shared-permissions@99.9.9 is a dependency-confusion reconnaissance package. package.json declares a postinstall script (`node index.js`) that runs automatically on `npm install`; index.js collects the installer's OS username (os.userInfo().username), hostname (os.hostname()), current working directory, and non-internal IPv4 address (from os.networkInterfaces()) and POSTs them as JSON via https.request to the hardcoded collector https://webhook.site/452b7e38-183d-4652-847d-0f2fa05b9389. The package name is styled to resemble a private internal scope, is published at version 99.9.9, and ships with empty description/author/license and no other functionality — the canonical namesquat/dependency-confusion probe shape used to identify build systems that resolve a private name to the public registry. https://db.gcve.eu/vuln/mal-2026-13664 Sat, 08 Aug 2026 00:52:01 +0000 https://db.gcve.eu/vuln/mal-2026-13630 --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126) scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching. --- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (22a1774c78b52b3d507d305227a1a258795a4e68d52b8366e0010c5d0bb80126) scripts/postinstall.js is obfuscated with hex-escaped identifiers and base64-encoded strings that hide standard API names ('https', 'fs', 'child_process', 'powershell', '.exe') and a download URL. On npm install, if process.platform === 'win32', the script decodes the base64 URL to https://files.catbox.moe/9bppy2.zip, downloads the archive to the system TEMP directory, expands it via PowerShell Expand-Archive, recursively walks the extracted tree for the first.exe, and spawns that binary detached before deleting the archive. The package is advertised as Roblox TypeScript type definitions and has no legitimate need for a Windows executable payload. files.catbox.moe is an anonymous throwaway file host permitting attacker-mutable content with no version pinning, hash verification, or publisher-matching. https://db.gcve.eu/vuln/mal-2026-13630 Sat, 08 Aug 2026 00:47:57 +0000