Malware in @dikaaofficial/libsignal-node

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in yonzofficial

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @dikaaofficial/eslint-config

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @chatbridgeworld/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in zhg.sql

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in gpa-core

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @velliajs/discord

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @velliajs/telegram

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in winks.tunnelsql

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in @massnerder/x402-scraper-mcp (npm)

Source: ossf-package-analysis 3c2359d61951f070234818950891a0ad6daca0a77d897b33992d5dba40d5b119 The OpenSSF Package Analysis project identified '@massnerder/x402-scraper-mcp' @ 1.0.0 npm as malicious. It is considered malicious because: - The package communicates with a domain associated with...

Malware in @gqb333/baileys

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @gqb333/based

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @devmikets/hyperliquid-sdk

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @polymarkets/clob-client-v2

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @hello.nrfcloud.com/proto-map

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in logger-libs (PyPI)

Source: kam193 b54fca41517078a9edbb6d6b4e5dbeb1eb522142f756a1b902f31a96d84a3e55 In this new incarnation of the campaign, the payload is spread between multiple files and reconstructed in runtime. It then downloads and executes malicious code from a remote location. --- Category: MALICIOUS - The...

Malware in u-chan-secrets

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in hello-world-pkg-value-value-p

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in env_test_guard (crates.io)

env-test-guard presents itself as a test toolkit for Rust projects that work with Git temporary repositories, environment guards, fixture builders, Git capability detection. Its GitEnv::detect, which the crate's own README and documentation examples call, runs a one-time "CI preflight"...

Malware in internal-company-module-test-1337

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in kafbail

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in seolibs-package

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malware in @ethersphere/bee-js

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in bundyfed (PyPI)

Source: kam193 81b2cc96166cfebf7a2fb72d280ca06f5b9c4c9c735f6aee4beceafbce5430de During installation, the package downloads a malicious executable holding an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-bundyfed Reasons base...

Malicious code in extrahtml (PyPI)

Source: kam193 f004357dd044b3c2c644a1f759dcd47a154a37533635280af0f3b5adb76469a4 In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub. --- Category:...

Malicious code in parseyaml (PyPI)

Source: kam193 21f0c643e1ed1b11c56bfdd5f7567b2c0172924c227206b8ab9e4210918c6ee3 In this campaign, remote code is executed via a dependency pretending to be a YAML loader but embedding a special loader executing code from a provided file. During analysis, the code was just a stub. --- Category:...

Malicious code in super-color (PyPI)

Source: kam193 908af2bf828b75158c5bf0aae5a9d422694f21f566a745ff42b82f1f7ed4560d Package hides a code downloading and installing an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-chromacli Reasons based on the campaign: -...

Malicious code in lookuptest11 (PyPI)

Source: kam193 fe5cc784eb96a4025bcd45731fcb19c3826a122a02ec4fed1cbee875fa2ca98b Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in rainbowcolors (PyPI)

Source: amazon-inspector c836e6786c8347157c05d664afcc653b445814cf73f36bc2a5157e41528ffbdd The package advertises itself as an ANSI-color helper but on Windows the first call to any Color method print/paint/call downloads an opaque executable solace.exe from an anonymous gofile.io file-share URL...

Malicious code in donjon-ledger (RubyGems)

Source: amazon-inspector 4ab38ebb03685b0ddfa31074b056e0a95da764170efe3026ed822ff7c8b3c247 The gemspec declares ext/mkrfconf.rb as a native extension, causing it to execute automatically during gem install. The script ships no C/C++/Rust sources and performs no build work. Instead it collects host...

Malicious code in infra-libs (PyPI)

Source: amazon-inspector 721b376b505d760e78f3ac8417b54789f538a5a8127f59fe7c2660067366ce32 infra-libs 99.99.99 performs install-time and import-time DNS exfiltration of the installer's hostname. setup.py constructs a subdomain label of the form install-- and calls socket.getaddrinfo against...

Malicious code in agentic-call-control (RubyGems)

Source: amazon-inspector 6604e2b2afca5be9f394786598898c0d718100ef3cb3595590fb74949b3eb9b5 The gem's native extension script executes during gem install and harvests installer-side data without consent. It collects host identifiers current working directory, home directory, hostname, login name an...

Malicious code in dynamic-object-handler (RubyGems)

Source: amazon-inspector bb6afd419500201966e8ccb55d2f3c8ea28caae5ec8bfc59a87dcf19ca9d022b The gem declares mkrfconf.rb as a native extension in metadata.yaml, causing it to execute automatically during gem install. The script collects the installer's current working directory, home directory path...

Malicious code in control-character-command-injection (RubyGems)

Source: amazon-inspector 83327b9e45cb49b02f4a3681837f5acdc84f15373a85648f4409946e6fa72f75 The gem declares an extension script in metadata.yaml that RubyGems executes during gem install. At install time the script reads host identifiers hostname, username, current working directory, home director...

Malicious code in supercolor-tui (PyPI)

Source: kam193 9798fa32337256d29d4b551193b6aa6817601034ce787bae4d09d7d6636d813b Package hides a code downloading and installing an infostealer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-11-chromacli Reasons based on the campaign: -...

Malicious code in blender-headless (PyPI)

Source: amazon-inspector 7edaff2bd9abfea10a907cf99f87b444eee0c7ff54e88face42fe7c000d64775 The sdist setup.py and the gcplogpoc/init.py module both construct a DNS label of the form install|import-random-id.blender-headless-platform.node as a subdomain of finaltests99.dssldrf.net and resolve it vi...

Malicious code in chromacli (PyPI)

Source: amazon-inspector faa55f651aa1c9e23d9cbff405b6ca52086c950c76e05e04b8dd49f74dd19959 The package presents itself as a terminal color library, but its exported API Color.paint / print / call contains an import-reachable Windows code path that downloads an unsigned executable from the anonymou...

Malicious code in expect-tests (PyPI)

Source: amazon-inspector f693b92cac909344a9cbab93f5f80ab6d820759af5042d323d90f10351d39d76 setup.py and gcplogpoc/init.py read the installer's hostname via platform.node and encode it into a subdomain of testa213022.dssldrf.net, then invoke socket.getaddrinfo to trigger DNS resolution to that...

Malware in @htooayelwinict/travis234

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...

Malicious code in twitch-stream-py (PyPI)

Source: kam193 bbb2267e685c94eee0456daa9e10960e5cacd1e010a93ecd34c9cd5effe07c9c Clone of a legitimate package with injected code that downloads and executes a script from a remote location. During analysis, the remote code was no longer accessible. The campaign was originally discovered by...

Malicious code in pyuserfox (PyPI)

Source: kam193 23edaa0c720d313b1598b1391f83081eab817e337c65033b28755ad7f46af0dd During import, package silently download and executes remote code. There is no other action. During analysis, the remote code was no longer accessible. The campaign was originally discovered by Threx-code. --- Categor...

Malicious code in pyuserox (PyPI)

Source: kam193 9554cf718372c4b1b545c805969d454a5baa65b62274339b1a00fd80ce6e7a86 During import, package silently download and executes remote code. There is no other action. During analysis, the remote code was no longer accessible. The campaign was originally discovered by Threx-code. --- Categor...

Malicious code in gcp-log-poc (PyPI)

Source: kam193 2435f0c2437e00d849505352dc39de8d98f7df8b6af4a98a2c39c7d4be4cc01c During import, package exfiltrates information about the environment, including potentially sensitive environment variables. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers...

Malicious code in qzc690384 (PyPI)

Source: kam193 dbd73fb476a20a6d0f4bc4fe820a007283789e6c03548f93e67fff7a58b2ede1 In this campaign, packages execute malicious code during installation. The exact behavior varies between versions: fingerprinting environment, exposing a backdoor server listening for remote commands, downloading remo...

Malicious code in qzc690382 (PyPI)

Source: amazon-inspector b34d702840be6773d3d41444f836f45dab6a8e3524fcc8e4cd6d224ac3a77f1e The package body is inert init.py contains only c\n; the entire functionality lives in setup.py, which runs on pip install. During install, setup.py writes a Python HTTP server script to /tmp/.kxs and launch...

Malicious code in qzc690383 (PyPI)

Source: amazon-inspector d4b997b7e9404963bfb44f2179abe28dd5238feac452fcce4b77fc945c430c06 On pip install, setup.py executes shell commands to collect installer host identifiers id, whoami, hostname, uname, nvidia-smi output, /proc/1/cmdline and issues an outbound curl to https://api.ip.sb/ip to...

Malicious code in qzc690385 (PyPI)

Source: amazon-inspector 84cc8690335a9ed7454c095286b0a9fd18141513f6d619e62a28d1b5f4751beb On sdist install, setup.py writes a Python HTTP server to /tmp/.zqx and launches it detached via nohup... & with startnewsession=True. The server binds 0.0.0.0 on ports 9998, 9999, 8089, 8099, and 8777 and...

Malicious code in genblaze-fal (PyPI)

Source: kam193 253796cb8693d039c09267f3d6d398031e3ad27640bb70f21f2e75d2578be649 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in pulumi-doppler (PyPI)

Source: kam193 50b46d564c0937fb09c4343eb0c9a8eb2d33b8b4eca8b85b5419ebd686100e06 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...

Malicious code in genblaze-atlascloud (PyPI)

Source: kam193 c8d0787ea4049d0bb0321d1b25591f303ee2a5d5351aeb725a67250d0ddf4188 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTEST - Packages looking like typical pentest packages, but al...