The npm package 'bcxhdh1kjlopsde' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package mw-communication-client contains malicious preinstall and postinstall scripts that send the installer's OS username, hostname, and current working directory via unencrypted HTTP requests to an attacker-controlled IP address. The package has no functional code and is a dependency-confusion proof of concept targeting private internal package names. It leaks sensitive environment information during installation without executing further code.
The npm package mw-test-utils (versions 1.0.0, 10.0.0, and 10.0.1) contains malicious preinstall and postinstall scripts that send the installing user's environment username, hostname, and working directory via unencrypted HTTP requests to a hardcoded IP address. The package contains no functional code and is labeled as a dependency-confusion proof of concept, but the scripts execute automatically on every install, potentially leaking sensitive environment information.
The npm package mui-wrapper-x-date-pickers versions 1.0.0 and 10.0.0 contains malicious preinstall and postinstall scripts that send the installer's OS username, hostname, and current working directory in plaintext HTTP requests to an untrusted external IP address. The package mimics the naming pattern of a legitimate internal package to exploit dependency confusion. No other code execution or payload is present beyond these data exfiltration requests.
The npm package monte-md-baileys version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. It achieves this by injecting code that issues an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channel identifiers are obfuscated or dynamically fetched to evade detection. This behavior does not involve credential theft, persistence, or remote code execution.
The noxleyss npm package is part of a large family of malicious forks of the Baileys WhatsApp Web library that inject code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated FOLLOW query using the victim's own WhatsApp session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The @rennnpm/baileys npm package version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by issuing an authenticated 'w:mex' FOLLOW query using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The seapy-ops package on PyPI, versions 1.0.0 through 1.2.2, contains malicious functionality hidden behind undocumented commands. It masquerades as a local file analysis tool but includes backdoor features that exfiltrate files from the user's working directory to an attacker-controlled server and allow remote code execution. The package uploads files recursively, including via symlinks, and can write arbitrary files into the working directory based on server responses. Later versions implement a Python REPL that sends input to the server and executes server-supplied code in memory, disguising errors to conceal activity. These behaviors were confirmed through isolated testing with synthetic credentials and mocked servers, without contacting live endpoints.
NIK C2 is an advanced AI-enabled command-and-control framework targeting Windows systems. It features a Go-based implant capable of credential dumping, keystroke streaming, and real-time AI-powered data analysis via the OpenAI Chat Completions API. The framework uses a dual-channel C2 architecture with TLS-secured WebSockets and HTTP fallback, employing AES-256-GCM encryption. It includes surveillance, lateral movement, screen-locking ransomware demanding cryptocurrency payments, and bootkit preparation. The implant employs advanced defense evasion techniques such as AMSI patching, process hollowing, and anti-debugging. Active infrastructure has been observed, confirming operational deployment beyond proof-of-concept. The framework is under active development with multiple versions compiled using Go 1.23.4.
The npm package @testsecuiitytestme/cache-helper is a malicious package that installs a credential stealer and self-propagating worm. It executes a native addon at install time that loads an obfuscated Bun program to collect a wide range of credentials and secrets from developer machines. The malware targets credentials from npm, GitHub, GitLab, PyPI, RubyGems, cloud providers (AWS, GCP, Azure), HashiCorp Vault, Kubernetes, SSH keys, browser logins, and password managers. It also propagates by publishing malicious packages and injecting CI/CD workflow changes and AI assistant configurations. The package was published and updated multiple times on October 27, 2026, then unpublished shortly after. Users who installed any version should consider all accessible credentials compromised and rotate them immediately.
NIK C2 is a newly observed AI-enabled command-and-control (C2) framework targeting Windows systems. It features a Go-based implant that provides persistent remote access with capabilities including credential dumping, keystroke streaming, RDP session hijacking, process hollowing, and deployment of screen-locking ransomware demanding cryptocurrency payments. The implant uniquely integrates the OpenAI Chat Completions API, allowing threat actors to analyze harvested data using AI in real time within the compromised session. This integration collapses traditional offline data processing delays, complicating detection and response efforts. The implant communicates over encrypted channels with resilient fallback mechanisms and has been observed in multiple evolving versions compiled no earlier than late 2024. Active infrastructure associated with NIK C2 has been identified in the wild, confirming its operational status.
The dsh-volcengine-provider npm package versions 0.2.5 and 0.2.8 contain malicious code. Any system with this package installed or running should be considered fully compromised, with potential unauthorized access to secrets and keys. Immediate removal of the package and rotation of all secrets from a separate, uncompromised system is strongly advised.
This threat involves fake Adobe Acrobat and "View & Sign" phishing pages distributing legitimate, digitally signed ConnectWise ScreenConnect remote access clients configured by attackers for unauthorized access. The campaign uses Telegram bots to track visitors, profile devices and networks, and selectively deliver the remote-access clients based on operating system and ISP checks. The installed clients connect to various attacker-controlled ScreenConnect Cloud tenants and establish persistent remote access with LocalSystem privileges. The threat leverages trusted software with valid digital signatures to evade traditional security controls, requiring defenders to detect unauthorized tenant configurations rather than relying on file hashes.
A sophisticated supply-chain attack named NetamLoader targets a custom Windows 10 build used exclusively by government entities in Asia. The attack uses a multi-stage infection chain involving CAB archives in Windows update directories, exploiting AppDomainManager injection and BinaryFormatter deserialization vulnerabilities. It bypasses AMSI protections, uses AES encryption for network communications, and employs anti-analysis techniques including long polling intervals and forensic evidence removal. The malware operates covertly by migrating to dllhost.exe and executing payloads in isolated AppDomains. Commercial hosting infrastructure such as Cloudflare CDN is used for command-and-control communications.
The npm package dsh-redteam-mode version 0.15.2 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
A malicious npm package named spectral-core impersonates a legitimate project and executes code during installation to steal sensitive environment variables and AWS EC2 metadata. It collects CI/CD secrets, cloud credentials, network reconnaissance data, and sends this information to a hardcoded external server. The package contains no functional library code and uses a binding.gyp file solely to run the malicious script at install time.
The npm package @dmangal/curse-dependent-ecto contains malicious code embedded in its binding.gyp file. During installation, it executes a node script that searches for files containing the marker 'HTB{' and reads sensitive files and environment variables. It then exfiltrates this data, including CI secrets and API tokens, to an attacker-controlled endpoint. The package uses an implausibly high version number consistent with a dependency confusion attack. Installing this package in developer or CI environments risks leaking confidential information to attackers.
The b20miner npm package version 0.3.1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised computer. Removal of the package alone may not eliminate all malicious software introduced by its installation.
The npm package @zaip-ai/cli contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package itsa-utils version 1.4.2 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.