/
initial_access_vector:supply_chain_compromise × victim_sectors:cryptocurrency × limpar

Resultados

2 casos · pág. 1/1

safedep.io · high

Deep-Live-Cam GitHub repo compromised: malicious dependency loads cryptocurrency clipboard hijacker on Windows and macOS

On September 8, 2026, an attacker added a malicious source dependency to Deep-Live-Cam, a Python face-swapping app with about 96,600 GitHub stars. Commit 7895c547 ("chore: update requirements.txt") rewrote 18 dependency entries and added requests @ git+https://github.com/pypls/requests.git. This points installation to a lookalike reposito…

technology cryptocurrency
thehackernews.com · high

MALFEX npm campaign: 'imgdecode' package hides shellcode loader in Windows native addon, delivers Node.js stealer/RAT

Researchers at SafeDep identified imgdecode, a malicious npm package tied to the long-running MALFEX supply chain campaign first documented by Checkmarx and CloudSEK. Published on September 30, 2026 by user "malfexteste8", it has been downloaded 979 times and was still available at the time of reporting (latest version 1.0.3). MALFEX has …

technology software development