---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (11bfe96b56a6615a50639b25de793e14044ea393c2029b26fa4e1b9e3dc5a22f)
This package impersonates the Anthropic Claude SDK (name and description claim to be an 'Official Anthropic Claude SDK wrapper', author is 'anthropic-tools') but ships a multi-stage dropper. The package.json declares `postinstall: node lib/cli.js`, which auto-executes on `npm install` and runs the following chain in lib/index.js:
1. Hardcoded C2 over bare IPs: POSTs to four hardcoded IP addresses (107.189.20.82, 107.189.20.146, 104.194.134.33, 104.194.133.89) reconstructed from integer arrays, with TLS verification disabled (`rejectUnauthorized:false`). The JSON response is base64-decoded and written to disk as `main.py`, then executed via a detached Python process.
2. Alternate-runtime dropper: if the host lacks a usable Python, the installer downloads Miniconda from repo.anaconda.com via curl/wget into `~/.local/share/prometheus/miniconda` (Linux), runs `winget install Python.Python.3.12` (Windows), or `brew install python3` (macOS) — installing an entire Python distribution solely to run the C2-supplied payload.
3. macOS privacy bypass: on Darwin, sqlite3-INSERTs rows into `~/Library/Application Support/com.apple.TCC/TCC.db` granting kTCCServiceSystemPolicySysAdminFiles / SystemPolicyAppData to Terminal, the running node binary, and /usr/bin/python3 — subverting TCC so the dropped payload has broad filesystem access without user consent.
4. Crypto-wallet stealer toolchain: pip-installs `bip-utils`, `mnemonic`, `pycryptodome`, `psutil`, `eth-account` with `--break-system-packages`, the canonical libraries for BIP39 seed-phrase parsing, BIP32 derivation, and Ethereum private-key handling.
5. Persistence: writes a `.cs_v2` marker and `main.py` under disguised paths impersonating system directories (`~/.local/share/com.apple.sync` on macOS, `~/.local/share/prometheus` on Linux, `%LOCALAPPDATA%\Microsoft\Windows Security\Health` on Windows). Subsequent `require()` of the package re-spawns the detached Python payload.
6. Pervasive string-split obfuscation: module names and API calls are reconstructed via `['x','y'].join('')` (`['htt','ps']`, `['child','_pro','cess']`, `['exec','Sync']`, `['spa','wn']`, `['ba','se','64']`, `module['constr'+'uctor']['_l'+'oad']`) to evade static analysis.
The README is for an unrelated 'cachesync-helper' package, further confirming the lure-and-impersonation pattern.
## Source: ghsa-malware (f1e490682c8dd38fd97c90b365eacf71086d64b57af905f96e58490ec35d5e6c)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Source: ossf-package-analysis (01d5845e6a8ba2bca29e99aaed593e5c7616c9ff89eb32d3d319dd65cf1839b0)
The OpenSSF Package Analysis project identified 'free-anthropic-claude' @ 5.0.0 (npm) as malicious.
It is considered malicious because:
- The package executes one or more commands associated with malicious behavior.
In createSessionInternal of PackageInstallerService.java, there is a possible method to remove a DPC app from a managed device without DO consent due to desync from persistence. This could lead to local escalation of privilege if a user can install a malicious app with no additional execution privileges needed. User interaction is needed for exploitation.
The npm package 'canary-ci-test' version 1.0.0 contains malicious code that executes during installation. Its postinstall script collects host identifiers such as hostname, username, current working directory, platform, and DNS resolution results, then silently sends this data to a hardcoded external URL without user consent. This behavior is unrelated to the package's declared purpose and constitutes install-time data exfiltration. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated. Removal of the package does not guarantee full remediation due to potential further compromise.
The npm package @dsft/ft-utils version 1.5.8 is a malicious package designed as a proof-of-concept for dependency confusion attacks. Upon installation, it executes a preinstall script that collects the installing project's directory name and sends this information along with a package identifier and timestamp to a remote third-party server without user consent. The package provides no legitimate functionality and acts solely as an install-time beacon. Systems with this package installed should be considered fully compromised, and all secrets and keys on the affected system should be rotated immediately from a different, trusted machine.
The npm package @dsft/ft-element version 2.5.9 contains malicious code that executes during installation. Its preinstall script sends a JSON beacon with the installing project's directory name to an attacker-controlled URL without user consent. This behavior leaks potentially sensitive project information and confirms a successful dependency-confusion attack. Although the author claims it is a harmless proof of concept, the unconditional data exfiltration constitutes a supply-chain attack. Systems with this package installed should be considered compromised, and secrets should be rotated immediately.
The npm package 'voyager-web' version 999.0.0 is a malicious typosquatting package that executes code during installation to exfiltrate sensitive host and CI environment information to an attacker-controlled Discord webhook. It collects system identifiers and CI secrets and sends them without consent. This package is a proof-of-concept for dependency confusion attacks but results in full compromise of any system where it is installed.
The npm package 'mcp-server-sequential-thinking' versions 0.0.1 and 0.0.2 is a malicious unscoped package impersonating the official @modelcontextprotocol/server-sequential-thinking MCP server. It executes code automatically on installation and when run, sending host identifiers and environment details to an attacker-controlled Cloudflare Workers endpoint without user consent. This behavior effectively compromises any computer with the package installed, potentially exposing all stored secrets and keys.
The npm package 'mcp-server-notion' versions 0.0.1 and 0.0.2 is a malicious package that collects host environment information during installation and sends it to a third-party endpoint without user consent. It masquerades as a legitimate package by occupying a confusable name and executes code on post-install to exfiltrate data. The package is considered a supply-chain attack vector and compromises any system where it is installed.
The npm package 'getd-ui-library' version 0.0.1 contains malicious code that executes a post-install script sending sensitive environment and system information to an external webhook URL without user consent. This package impersonates a legitimate scoped package to trick developers into installing it. Installation results in leakage of hostnames, usernames, platform details, current working directory, and CI environment variables, potentially enabling targeted follow-on attacks. The package's README claims defensive research but does not mitigate the privacy and security impact. Removal of the package does not guarantee full remediation as the system may be fully compromised.
The getui-library npm package version 0.0.1 contains malicious code that executes during installation. Its postinstall.js script sends an HTTPS request to a third-party webhook, exfiltrating installer environment details such as hostname, username, platform, working directory, and CI indicators without user consent. This behavior is triggered automatically on npm install and is intended to fingerprint developers who mistakenly install this typosquatted package. The package is considered fully compromising to any system where it is installed, potentially allowing an attacker full control. Immediate removal and secret/key rotation are advised.
The @rockawayx/utils npm package (version 0.0.1) contains malicious code that executes a preinstall script to silently exfiltrate host system information to a hardcoded IP address. This package squats the unclaimed @rockawayx npm scope and sends data such as hostname, username, platform, and timestamp without user consent. The package masquerades as authorized security research but performs unauthorized data transmission during installation. Systems with this package installed should be considered fully compromised.
The npm package @open-banking/cabinet-providers versions 999.9.2 and 999.9.5 contains malicious code that executes automatically upon installation. It exfiltrates sensitive system information including the contents of /etc/passwd and host identity data by sending them to attacker-controlled endpoints. This behavior occurs without user consent during the npm install process, posing a severe risk to any system where the package is installed.
The @doaction/examples npm package version 99.99.99 (and also 9.9.9) contains malicious code executed during installation via a preinstall hook. This hook runs a script that loads telemetry code from a sibling package, which collects environment variables and sends them to a remote destination without user consent or opt-out. The package is labeled 'for internal testing' but is publicly available, enabling dependency confusion attacks where organizations expecting internal @doaction packages may inadvertently install this malicious public package. The presence of inconsistent script naming further obscures the malicious behavior. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems must be rotated immediately. Removing the package alone may not fully remediate the compromise.
The @doaction/sudo-prompt npm package is a malicious package that impersonates the widely-used sudo-prompt package but lacks its intended privilege-escalation functionality. Instead, it performs environment telemetry by sending data to Datadog during installation without user consent. There is no evidence of credential theft, remote code execution, or attacker-controlled data exfiltration endpoints. However, the package name overlap can mislead developers into installing this telemetry shim unintentionally. Security advisories caution that any system with this package installed should be considered fully compromised, recommending immediate secret rotation and package removal.
The WP GDPR Cookie Consent plugin for WordPress versions up to and including 1.0.0 contains a stored cross-site scripting (XSS) vulnerability. This flaw arises from missing capability and nonce checks in an AJAX handler and insufficient input sanitization combined with missing output escaping in CSS generation. Authenticated users with subscriber-level access or higher can inject malicious scripts that execute when other users load affected pages.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (63dac830216ae445ebe7c5f45534e479d73a23a098ea9fc5740eeded5ebab4c9)
On `npm install`, the package's preinstall script (preinstall.js) collects the installer's hostname, OS username, current working directory, and a timestamp, then sends them to two attacker-style out-of-band endpoints: a DNS lookup of a subdomain under `oast.fun` (an Interactsh-style callback service) constructed from the installer's identifiers, and an HTTPS POST of a JSON payload to a `webhook.site` URL. The package itself provides no functionality — it is a high-version (99.0.1) namespace-confusion lure against an internal `@aonunited/angular` package, designed so that any environment whose resolver picks the public registry copy will auto-execute the beacon. Although the metadata describes this as authorized HackerOne VDP research, the package is published to the public npm registry, so any developer or build system that installs or mistypes it leaks host fingerprints to third-party infrastructure without consent.
## Source: ghsa-malware (edcefa4f7ecdb8b1bf87735af2b0de89a74794dda4d8fbac66b99eaa7914d861)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
## Source: ossf-package-analysis (411e19a999b3354e6b5ad40e6da82882c1bf314a35d722ade7b3e23eb9c4a46c)
The OpenSSF Package Analysis project identified '@aonunited/angular' @ 99.0.1 (npm) as malicious.
It is considered malicious because:
- The package communicates with a domain associated with malicious activity.
The npm package mamadoos-test contains malicious code that executes a preinstall script during npm install. This script sends the installer's OS username, hostname, and current working directory to a third-party URL without user consent. The package also declares itself as a dependency, consistent with dependency confusion tactics to capture internal environment details. This behavior can lead to unconsented exfiltration of host-identifying information useful for follow-on attacks.
The npm package 'claw-subagent-service' installs a privileged Windows service that runs as LocalSystem without user consent. It establishes a persistent remote-control channel via a vendor-controlled IM backend, enabling arbitrary command execution and continuous data exfiltration from the host. The service self-updates silently every six hours, fetching and executing new versions with elevated privileges. This behavior creates a vendor-operated remote administration agent with persistent privileged access on affected machines.
CVE-2026-40068 is a high-severity vulnerability in anthropics Claude Code versions 2.1.63 through 2.1.83. The issue arises from improper input validation of the git worktree commondir file used in folder trust determination logic. An attacker can craft a malicious repository with a commondir file that points to a path the victim has previously trusted, causing Claude Code to bypass its trust confirmation dialog and execute hooks defined in . claude/settings.json without user consent. Exploitation requires the victim to clone the malicious repository and run Claude Code within it, and the attacker must know or guess a trusted path on the victim's system.
CVE-2026-42235 is a high-severity vulnerability in the n8n workflow automation platform affecting versions prior to 1.123.32, 2.17.4, and 2.18.1. It allows an unauthenticated attacker to register a malicious OAuth client with a crafted client_name that leads to improper neutralization of alternate XSS syntax. When a victim user authorizes the OAuth consent and another user revokes access, a toast notification renders injected script, enabling execution of arbitrary JavaScript in the victim's authenticated session. This can result in credential and session token theft, workflow manipulation, or privilege escalation.