The npm package 'dependencykfeg' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone may not eliminate all malicious software introduced by its installation, as attackers may have gained full control over the system.
The bq-helix-build-hook-6ade983e package on PyPI version 0.1.0 contains malicious code that collects sensitive information from the environment during installation. This includes credential files, environment variables, and data from cloud metadata endpoints, which are then exfiltrated. The campaign associated with this malware is identified as 2026-10-bq-helix-recon and is characterized by clear malicious intent to steal information.
The bq-helix-recon-6ade983e package on PyPI contains malicious code that executes on every Python startup by placing PTH/sitecustomize files. This code collects sensitive information such as credential files, environment variables, and cloud metadata, then exfiltrates this data. The campaign associated with this package is clearly malicious, functioning as an infostealer targeting cloud tokens and other credentials.
The orderbook-volt-plugin npm package versions 0.0.0-stage, 0.0.1, and 0.0.2 contain malicious code. Any computer with this package installed or running should be considered fully compromised. Secrets and keys stored on the affected system must be rotated immediately from a different, clean machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The react-native-drago-callkit npm package contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the potential for persistent malicious software, complete remediation may require additional measures such as rotating all secrets and keys from a different, secure computer.
The npm package @chatunitycenter/baileys contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, trusted computer are strongly advised.
The npm package '789bet-vip-login' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package '789bet-vip-online-login' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but due to potential full control by an attacker, removal may not eliminate all malicious components. Secrets and keys should be rotated from a separate, uncompromised device.
The npm package '789bet-vip' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is recommended, but full remediation may require rotating all secrets and keys from a different, uncompromised system due to potential persistent control by attackers.
The npm package '789bet-login-th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, clean machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package '789bet-entrance' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have established persistent control.
The npm package '789bet-slot' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of all malicious components, as attackers may have established persistent control.
The m98vip npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.
The npm package 'm98th' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The m98bet npm package contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, secure machine. Removal of the package alone does not guarantee eradication of all malicious software introduced by it.
The npm package '789bet' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected machine. Removal of the package alone may not eliminate all malicious software introduced by its installation.
The npm package @pcb-dp/qa-commons contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the extent of the compromise, simply removing the package may not eliminate all malicious software. Secrets and keys should be rotated from a different, secure computer.
The npm package @jasperquinn/postcss-motion-helpers contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a different, uncompromised machine. Removing the package alone may not eliminate the malicious presence, as the attacker may have established persistent control.
The black-spindle-2 npm package contains malicious code in its postinstall script. This script executes automatically upon installation and makes an HTTP request to an anonymous ngrok-free.app URL, embedding shell command substitution. This behavior can confirm installation on the host and potentially exfiltrate environment or host data. The package's main code is an empty stub, indicating the postinstall script is the primary malicious component.
The poc-revshell package version 0.1.0 on PyPI contains a reverse-shell backdoor that activates both during installation and import. It opens a TCP connection to localhost on port 4444, providing an interactive shell to any local listener. This backdoor runs with the installing user's privileges and is confined to local attackers on the same host.