Snyk Security Database

typo-crypto is a malicious package. This package contains a trojanized core.js file mimicking the legitimate core-js package. The malware activates when it receives a hash input beginning with 0098273, then downloads a second-stage payload from a hardcoded C2 server and runs Windows, macOS, or Linux specific behavior, concealing itself with base64 plus an XOR cipher keyed to 01042025 and maintaining file-based persistence with payload rotation.

Note: This package's malicious behavior may be linked to that of the compromised versions of chalk, debug, and axios.

phabricator-client is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship.

org.apache.axis2:axis2-kernel is a Web Services / SOAP / WSDL engine, the successor to the widely used Apache Axis SOAP stack.

Affected versions of this package are vulnerable to Deserialization of Untrusted Data the Tribes-based clustering channel in org.apache.axis2.clustering.tribes.Axis2ChannelListener#messageReceived. An attacker can execute arbitrary code by sending a crafted serialized Java object to the clustering port when clustering is enabled. This affects deployments on Apache Tomcat with Tribes clustering enabled, allowing unauthenticated remote code execution and a full compromise of the Axis2 application process.

Notes

• Tribes clustering was off by default; the exposed deserialization path only exists in deployments that explicitly enable the clustering channel on Apache Tomcat.