The @ifasn/mdd-doc-mcp npm package contains malicious code that, upon loading, attempts to steal Alibaba Cloud ECS instance role credentials by querying the instance metadata service and extracting security tokens. It disguises this activity as benign diagnostics. Additionally, it downloads and executes a dependency from an untrusted HTTP source without integrity checks, enabling arbitrary code execution during installation. This behavior is unexpected given the package's declared purpose as a Markdown documentation tool.
The npm package service-roles-registry version 99.0.2 contains malicious code that executes a preinstall script. This script collects host identifiers such as hostname, user info, current working directory, and package metadata, then sends this data to a hardcoded external endpoint without user consent. The package appears to be a dependency confusion lure designed to override an internal package of the same name.
The npm package 'bfvkjmeikpwhqxc' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The 'internal-renderers' npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
The npm package 'pandafortunerush' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone may not eliminate all malicious software introduced by its installation, as full control of the computer may have been granted to an attacker.
The npm package @levvicode/eslint-config contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @maulenv/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'nachles' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package @levvicode/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee elimination of the malicious software, as full control may have been granted to an external attacker.
The @levvicode/baileys npm package versions 0.0.2 and 0.0.3 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The levvleys npm package, part of a large family of Baileys WhatsApp Web library forks, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. This covert subscription occurs via an injected FOLLOW query after connecting to WhatsApp, with target channels obfuscated or dynamically fetched. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The tailwind-animate-engine npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software or control established by the attacker.
The tailwind-animatrix npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, secure machine. Removing the package alone may not fully eliminate the malicious presence due to potential persistent control by an attacker.
The npm package 'tailwind-animate-final' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by the package.
The unjailed npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee full remediation, as the attacker may have established persistent control over the system.
The npm package 'tailwind-animate-test' contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package @mrlegendbot/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough to consider the system fully controlled by an attacker, necessitating immediate rotation of all secrets and keys from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious components.
The npm package @bigdevin55/calculator-install-demo contains malicious code that can fully compromise any computer on which it is installed or executed. The compromise may allow an attacker to gain full control over the affected system, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised device is strongly advised.
The npm package '@bigdevin55/calculator-install-hook' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
The tailwindcss-animate-bridge npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone may not eliminate all malicious software, as the attacker may have gained full control of the system.