The npm package 'blitzstrike' version 2.4.180 contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a separate, secure machine. Simply removing the package may not eliminate all malicious components due to potential persistent backdoors or additional malware installed.
The dsh-moss-wallpaper package version 3.4.0 on npm contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, removal alone may not eliminate all malicious software. Secrets and keys should be rotated from a different, uncompromised machine.
The npm package 'vibes-plug' version 4.5.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control over the system.
A large-scale supply chain compromise affected MECOOL Android set-top boxes manufactured by Videostrong Technology Co., Ltd. Over 1.3 million devices were pre-infected with the x.cpe backdoor, enabling system-level access via MQTT infrastructure. The backdoor deploys multiple payloads including residential proxy SDKs and various ad fraud modules. Approximately 500,000 infected devices remain active, primarily in Malaysia, Mexico, and Brazil. The operation supports a pay-per-install campaign that fuels ad fraud and proxy ecosystems. Google has permanently banned Videostrong from the Android ecosystem due to this compromise.
BITTER is a cyberespionage group targeting South Asian government, energy, and engineering sectors using a custom remote access trojan called PapRAT. PapRAT is deployed through multiple infection chains involving malicious LNK files, VHDX disk images with MSI installers, and URL shortcuts combined with WebDAV. The malware exists in C++ and Rust variants, with capabilities such as command execution, file and directory manipulation, screenshot capture, and secondary payload delivery. Persistence is maintained via scheduled tasks, and communication with command-and-control servers occurs over HTTP. The Rust variant adds enhanced features including PowerShell execution and sleep commands.
The npm package dsh-moss-console version 3.3.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The luna-baileys npm package contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system. Immediate rotation of all secrets and keys stored on the compromised computer is strongly advised. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The npm package 'paidwithtab' version 3.0.0 contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a different, uncompromised computer due to the risk of persistent malicious software.
The dopc-client RubyGem versions 1.0.0 and 10.0.0 include malicious code that performs an unconsented plaintext HTTP GET request to a hardcoded IP address. This request sends sensitive environment information such as the installer's OS username, hostname, and current working directory to a third-party endpoint controlled by the author. The behavior occurs as a side effect of requiring the gem and is not configurable or opt-in by the user.
The npm package @atedone/workspace-context contains malicious code that executes upon import. It writes shell integration files to the user's home configuration directory and spawns a detached interactive zsh shell with a persistent hook that executes a script on every prompt. The package fetches remote content over unencrypted HTTP from a hardcoded IP address, injecting attacker-controlled data into the user's shell prompt, enabling remote code execution via prompt expansion. The code uses obfuscation techniques to hide its use of child process spawning and network fetching APIs. This behavior is unrelated to the package's stated purpose and represents a severe security risk.
The scdn-jquery npm package version 0.1.6 contains obfuscated malicious code in the file libs/18.2.0.js. This code loads a remote script that inserts an invisible iframe to deliver iOS-specific exploit code based on the visitor's device version. The malicious loader executes in the browser when the script is served, masquerading as jQuery. There is no evidence of malicious code execution during npm installation.
The npm package @corexium/xbails version 0.0.7 imports a third-party package '@bellaxchuu/libsignal-node' using a mutable '@latest' tag without version pinning or integrity checks. This allows the maintainer of the aliased fork to execute arbitrary code at module load time, including within cryptographic session handling.
The pyprig package on PyPI is a malicious clone of the legitimate Pydantic package. It includes code that downloads and executes a remote script from a GitHub repository during the initialization of any models, injecting a runner module. The remote code observed during analysis was a placeholder, but the package's intent is clearly malicious.
The @ifasn/mmd-doc-mcp npm package contains malicious code that probes cloud instance metadata service endpoints for AWS, GCP, Azure, and Alibaba clouds. It collects HTTP status codes from these endpoints to identify the cloud provider and presence of attached IAM/RAM roles, then sends this data in plaintext to a hardcoded external server. The package falsely advertises itself as a markdown table-of-contents server, but performs unauthorized reconnaissance of cloud credentials metadata services.
The npm package @ifasn/md-doc-mcp contains malicious code that, upon import or startup, probes cloud instance metadata services from AWS, GCP, Azure, and Alibaba Cloud. It exfiltrates the collected metadata via plaintext HTTP requests to a hardcoded external IP address and its nip.io alias. This behavior is unrelated to the package's declared markdown toolkit functionality and is disguised by misleading source code comments. The exfiltration of cloud environment details enables third-party reconnaissance for potential follow-on attacks targeting cloud credentials or instances.
The npm package @ifasn/mmdd-doc-mcp, which claims to be a Markdown TOC/stats/table MCP server, contains malicious code that, upon startup, performs unauthorized access to Alibaba Cloud ECS instance metadata service (IMDSv2). It retrieves temporary security credentials and sensitive host files such as /etc/shadow, /etc/passwd, SSH private keys, environment files, and Kubernetes service account tokens, writing this data to local files. This behavior is unrelated to the package's stated functionality and constitutes unauthorized credential and sensitive data harvesting.
The @ifasn/mdd-doc-mcp npm package contains malicious code that, upon loading, attempts to steal Alibaba Cloud ECS instance role credentials by querying the instance metadata service and extracting security tokens. It disguises this activity as benign diagnostics. Additionally, it downloads and executes a dependency from an untrusted HTTP source without integrity checks, enabling arbitrary code execution during installation. This behavior is unexpected given the package's declared purpose as a Markdown documentation tool.
LLMJacking is a tactic where threat actors hijack enterprise access to Large Language Models (LLMs) by exploiting exposed cloud credentials and API keys. This activity has impacted organizations in North America, South America, and Asia Pacific across multiple sectors including financial services, retail, technology, and transportation. Unlike cryptojacking, LLMJacking causes sudden and massive spikes in fraudulent cloud usage charges, sometimes exceeding $100,000 USD daily and accumulating to over $1 million USD. Attackers gain initial access through stolen or exposed cloud identity tokens, IAM credentials, service account keys, and API keys, then escalate privileges and conduct reconnaissance. They monetize compromised resources via LLM Mixers, which are illicit routing gateways that proxy and resell unauthorized LLM access. The threat ecosystem is highly organized with specialized operational clusters coordinating both compromises and monetization infrastructure.
The npm package service-roles-registry version 99.0.2 contains malicious code that executes a preinstall script. This script collects host identifiers such as hostname, user info, current working directory, and package metadata, then sends this data to a hardcoded external endpoint without user consent. The package appears to be a dependency confusion lure designed to override an internal package of the same name.
The npm package 'bfvkjmeikpwhqxc' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
