Weakness (CWE)
CWE-506: Embedded Malicious Code
The product contains code that appears to be malicious in nature.
How to prevent it (1 mitigation)
-
Implementation, Operation
Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.
Source: MITRE CWE-506
459 results · Feed
-
Critical 9.1
Malicious Package in bitcionjs
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bitcion-ops
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bictore-lib
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bip30
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bictoinjs-lib
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bictoind-rpc
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bictoin-ops
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bconi
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in bcion
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in baes-x
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in babel-loqder
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in babel-loadre
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.1
Malicious Package in babel-laoder
All versions of this package contained malware. The package was designed to find and exfiltrate cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stor…
-
Critical 9.8
Malicious Package in cxct
All versions of `cxct` contain malicious code. The package finds and exfiltrates cryptocurrency wallets. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that comp…
-
Critical 9.8
Malicious Package in malicious-npm-package
All versions of `malicious-npm-package` contain malicious code. The malware targets Windows systems. It runs a powershell command that downloads an executable file from a remote server and runs it. ## Recommendation Any computer that has this package installe…
-
Critical 9.8
Malicious Package in sj-labc
All versions of `sj-labc` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets a…
-
Critical 9.8
Malicious Package in superhappyfuntime
All versions of `superhappyfuntime` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All…
-
Critical 9.8
Malicious Package in arsenic-tabasco-cyborg-peanut-butter
All versions of `arsenic-tabasco-cyborg-peanut-butter` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. ## Recommendation Any computer that has this package installed or running should be considered ful…
-
Critical 9.8
Malicious Package in sj-tw-abc
All versions of `sj-tw-abc` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets…
-
Critical 9.8
Malicious Package in sj-tw-sec
All versions of `sj-tw-sec` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets…
-
Critical 9.8
Malicious Package in sj-tw-test-security
All versions of `sj-tw-test-security` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. ## Recommendation Any computer that has this package installed or running should be considered fully compromised. A…
-
Critical 9.8
Malicious Package in owl-orchard-apple-sunshine
All versions of `owl-orchard-apple-sunshine` contain malicious code. The package downloads and runs a script that opens a reverse shell in the system. ## Recommendation Any computer that has this package installed or running should be considered fully comprom…
-
Critical 9.8
Malicious Package in zs-sha3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in ns-sha3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in ks-sha3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in jw-sha3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in jsmsha3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-sxa3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-wha3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-sla3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-sja3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-sia3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-shq3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-shi3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-she3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-shc3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-shas
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-sha7
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-rha3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.
-
Critical 9.8
Malicious Package in js-qha3
Version 0.8.0 contained malicious code. The package targeted the Ethereum cryptocurrency and performed transactions to wallets not controlled by the user. ## Recommendation Remove the package from your environment. Ensure no Ethereum funds were compromised.