/
data_types_exposed:credentials × victim_sectors:cryptocurrency × latest_source_host:safedep.io × limpar

Resultados

2 casos · pág. 1/1

safedep.io · high

42 Malicious RubyGems Run Install-Time Reverse Shell and Downloader Targeting Crypto Developers

On October 5, 2026, the RubyGems account reqthrottle3474 published 42 malicious gems within about an hour. Most are named for cryptocurrency developer tooling (e.g. eth-keystore-utils, bip39-wordlist-utils, btc-wallet-tools), and the last 16 typosquat real gems (bitcion, etheremu.rb, kecack, solaan-ruby). The code runs during gem install …

cryptocurrency software development
safedep.io · high

MALFEX npm campaign moves its loader into imgdecode, a native Windows addon that injects shellcode into dllhost.exe

SafeDep reports that the npm package imgdecode (versions 1.0.0-1.0.3, publisher malfexteste8) is part of the MALFEX campaign, which targets Windows developers. After npm removed earlier JavaScript loaders, the operator moved the loader logic into a compiled Node.js native addon (a Windows DLL). On require('imgdecode') from an interactive …

MALFEX software development cryptocurrency