Malicious code in @galicia-toolkit-nestjs-20-lite/archetype (npm)

@galicia-toolkit-nestjs-20-lite/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beac...

Malicious code in @galicia-toolkit-nestjs/commons (npm)

@galicia-toolkit-nestjs/commons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in @brick-v2/core (npm)

@brick-v2/core is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in sharpnes (crates.io)

sharpnes is a malicious crate published to crates.io on 2026-10-09 by the account crows7781-glitch versions 0.1.0 and 0.1.1, described only as "The sharpnes project is a learn.". It is an infostealer that exfiltrates data to attacker-controlled Telegram bots when the exported async function...

Malicious code in @brick-v2/icons (npm)

@brick-v2/icons is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @brick-v2/table (npm)

@brick-v2/table is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @galicia-toolkit-nestjs-20/archetype (npm)

@galicia-toolkit-nestjs-20/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...

Malicious code in @galicia-toolkit-nestjs/archetype (npm)

@galicia-toolkit-nestjs/archetype is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in @galicia-toolkit-nestjs/paas (npm)

@galicia-toolkit-nestjs/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim...

Malicious code in @galicia-toolkit-nestjs-20-lite/paas (npm)

@galicia-toolkit-nestjs-20-lite/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon th...

Malicious code in @galicia-toolkit-cheques-nc/front (npm)

@galicia-toolkit-cheques-nc/front is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in @galicia-toolkit-nestjs-20/paas (npm)

@galicia-toolkit-nestjs-20/paas is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in @brick-v2/form (npm)

@brick-v2/form is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the victim's hostname...

Malicious code in @galicia-toolkit-nestjs/swagger (npm)

@galicia-toolkit-nestjs/swagger is a dependency confusion package published to npm on 2026-10-09 by the account s4yhii, targeting the internal @galicia-toolkit- / @brick-v2 package namespaces with inflated versions e.g. 999.0.x. Early versions resolve ..dc.oob.s4yhii.com via DNS to beacon the...

Malicious code in revine (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3dbf4288af8869a7f4875c4de38fa05874802fc4f0fda831170aa143bc1dbb9a Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in testrrrd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 91a77cc9dbdff4799414082dc85fc6581b9f2d7297136dea8c50540f7d5244ad On npm install, package.json scripts.postinstall runs node beacon.cjs, which POSTs a JSON payload containing the installer's hostname os.hostname,...

Malicious code in @wxwxtest/testrrrdd (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2c288e48135ebe9f305d450f5b19324ae944865fb7057ced986d0eb30cb1fe34 The package ships a postinstall script scripts.postinstall runs node beacon.cjs and a top-level require'./beacon.cjs'.fire in index.js that POST...

Malicious code in wie888r (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector b3f438329492b2e0f2917a0eebe97ad8149149b66cd5eb9201bed0b8f5750e7b [email protected] ships a stub main index.js that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name d...

Malicious code in xblaxw (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 2d2e0b35582727d314517ea66b234f665258076783678cdf645075a7294a0aed [email protected] is a stub package whose only behavior is a beacon. The package.json postinstall script runs node beacon.cjs, which collects host...

Malicious code in css-overscroll-contain (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 5d978121f021eb6136e6a34db790556ba757de3bb8fa81981903445baf025d16 The package advertises itself as a CSS overscroll-behavior utility but its shipped modules thunderboltRegistry.js and sibling files named after...

Malicious code in kafka-helmsman (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 75536e8621da28a0e941bd4a607da879a64ab71214e908992bf14840ed9a20b2 The sdist for kafka-helmsman 99.0.5 is a dependency-confusion placeholder targeting the internal Tesla project name...

Malicious code in kafka-roller (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 4490e03c9b281c985d7cc5c877d359f8f3789a2ec44421602137c461ac4a2a52 The package is published to PyPI under the name kafka-roller with metadata impersonating Tesla's teslamotors/kafka-helmsman project homepage points a...

Malicious code in @kxafunc/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 629c665fbfef767c56d24af935d38312f7aa88d1c71d9dfb8c427192e54add0b package.json aliases the libsignal dependency to npm:@bellaxchuu/libsignal-node@latest — a non-standard publisher pinned to the mutable latest dist-t...

Malicious code in @bitwardne/jslib (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 030f216bf15ed7a6a7cde4ad43606804f1eaad03723f3f40844260d9e8ccf39d Package @bitwardne/jslib is a one-character typosquat of the @bitwarden scope. Its package.json declares a preinstall lifecycle script of the form cu...

Malicious code in @bitwardne/cli (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector cf7d0b3168a3a56cb6208688970e6109a964ccfb99a97fe7061d57e007b67ca6 package.json declares a preinstall lifecycle script of the form 'curl -L | node', which fetches remote content and executes it in Node at npm install...

Malicious code in clickfix_npm_delivery (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector f795362044848bcb73d95317e8761c4315720d6a052c6c88fdab47065499510d The package has no library surface. package.json declares main: index.html and the tarball ships only that HTML page, whose sole purpose is a ClickFi...

Malicious code in @galicia-toolkit/core (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware be976704e590db4fd796db1569b0835af0dfc8d829e21282116f210a4c741a59 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcss-effects-kit (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 12c9b58efdc05227da51bfb1031a80205144b4c6945b06eb9cbad7d416ab4873 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in tailwindcss-ui-extensions (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware deb799e18fe77928819080979322bbcc868ba4373af021aec1efea4b201e4108 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @galicia-toolkit/error-master (npm)

@galicia-toolkit/[email protected] claims the @galicia-toolkit scope and describes itself as a dependency-confusion PoC. Its postinstall hook runs on npm install using node postinstall.js || true and sends encoded hostname, working-directory, platform, runtime-version, and username data as DNS...

Malicious code in @galicia-toolkit/tag-manager (npm)

@galicia-toolkit/tag-manager claims the @galicia-toolkit scope and describes itself as a dependency-confusion PoC. Its postinstall hook runs node postinstall.js || true on npm install; the script collects host, platform, runtime, network, and environment data, then sends it over HTTP to...

Malicious code in @galicia-toolkit/spa-build-config (npm)

@galicia-toolkit/[email protected] and @galicia-toolkit/[email protected] claim the @galicia-toolkit scope and describe themselves as dependency-confusion PoCs. Their postinstall hook runs on npm install with node postinstall.js || true. The script collects package and host...

Malicious code in system-driver (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware ad5e4a0cbbe434f312002efedefa09d6d1ad79d13300812d7b43e1302fd6e562 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-fetch-lite (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3e96b428b5de9465675c8a84b41aef8afbb1f4b62ab7ef7fb437bb53692095e0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-gyp-runtime (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bcec19492c8bdcd8c866d1aad1a2b8a253d7d9bbc8184ff182af71a75ce56589 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in connector-agent (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2d9f20c94a9242e8d3ee6ef52fd22dfb8e57a8c08ae3ff52776b7ba3234f1702 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-env-resolve (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 6f3e0e1b364a3d74534d6ce1eca74778a85e508cf10952f84f36bf1badd8a581 The package is advertised as an environment configuration resolver but its postinstall script installs a hidden persistent agent into user-level...

Malicious code in @bellaxchuu/overbugs (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f4bf34e6d2aa5b187e4dba9c90ce9515cd1fdc5a43f37195ba21e9cb418eb19c Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bellaxchuu/familyxtrx (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @bellaxchuu/privatebails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @bellaxchuu/libsignal-node (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 69f70788aeca5b98fbe0c721d7f6a88c036d661c3f0132443a6bdb97080f5819 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bellaxchuu/velvetry (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @bellaxchuu/skyblue (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @bellaxchuu/xtrxbails (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @bellaxchuu/flowblue (npm)

This package is part of a large family 100+ identified as of September 2026 of near-identical forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into the WhatsApp socket layer. On connect, the injected code issues an authenticated w:mex FOLLOW query queryid...

Malicious code in @bellaxchuu/xbailey (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d07ffaff1ea6694d0579feba4090d61917939563b17e9395b875bb0c2aaf0b01 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bellaxchuu/yarnbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1f991cf1a14df0cd0bbec0bd9340f983ea34dc98070e0e1c810e22653aecf469 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bellaxchuu/xbails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f73138335788b7e9bb6c1df9db9ae6f82fa260c75d703ddfb850cba883c7d076 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @bellaxchuu/bails (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6ca3e47d499dc50a641bc4c0d6c01228aa55dfcf76a4c8504680ce1dc1196e4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in brat-generator (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 53137fe02a825bde6d844ec337cba590b1c454e97e52c2792358555eea1dd76b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...