MALFEX Moves Its npm Loader into a Native Windows DLL
The MALFEX package imgdecode contains a native Windows loader. When loaded from a console, it attempts to download, decrypt, and inject shellcode into dllhost.exe.
Blog
Follow for the latest updates and insights on
open source security & engineering.
Latest From SafeDep
ASOS App Hack: Attackers Used Push Notifications to Send a Ransom Note
Attackers got into the platforms ASOS uses to message customers and pushed an extortion note to phones. Here is what is confirmed, what is only claimed, and what customers should do.
42 Malicious RubyGems Open a Reverse Shell at Install Time
One RubyGems account published 42 gems that run code during gem install. On a developer workstation, the gems open a reverse shell or download a second stage. They do nothing on CI runners and...
tensorlake 0.5.144 npm Compromise Ships Mini Shai-Hulud
[email protected] on npm ran a Mini Shai-Hulud worm at install. A maintainer account committed the payload through the GitHub web interface, and the official release workflow published it.
An Attacker Hijacked an AI Coding Assistant to Spread a Worm
An attacker took over a live AI coding assistant session, got it to recommend a poisoned package, and used the stolen tokens to spread the Shai-Hulud worm across about 100 internal repositories.
Stay ahead of supply chain threats
Get the latest on newly discovered malware, active campaigns, and open source security research, delivered to your inbox.
Ship Code.
Not Malware.
Start free with open source tools on your machine. Scale to a unified platform for your organization.
