The npm package 'black-spindle' version 999.0.0 has been identified as malicious by the OpenSSF Package Analysis project. It exhibits malicious behavior by communicating with a domain linked to malicious activity and executing commands associated with harmful actions. This package poses a security risk to users who install or use it.
The npm package @zmtcdn/components version 9999.0.0 is a malicious dependency-confusion package. Its postinstall script collects system information including hostname, username, platform, working directory, and environment variable names, then sends this data to an external logging service. This reconnaissance can expose sensitive environment variables such as CI or secret tokens, potentially leading to credential theft. The package was published by the npm account kill_shs, which also published a similar malicious package @zmtcdn/ui.
The npm packages @zmtcdn/ui versions 9999.0.0 and 9999.0.7 are malicious dependency-confusion packages that execute a postinstall script sending system environment details to an external server without user consent. The postinstall script collects hostname, username, platform, working directory, environment variable names, and a timestamp, then sends this data to https://www.hinny.shop/api. These packages were published by a suspicious npm account and have no legitimate functional purpose for this data transmission.
The npm package identity-two-factor@999.0.0 is a malicious dependency-confusion package targeting Coinbase. It contains no functional code but executes a postinstall script that collects system metadata and exfiltrates it to a third-party webhook URL. This unsolicited data exfiltration occurs automatically upon installation without user authorization.
The npm package spectral-net-probe contains malicious code in versions 1.0.1, 1.0.4, and 1.0.10. These versions execute code during installation or loading that contacts remote servers to exfiltrate local files specified by the attacker. This behavior constitutes a supply-chain attack leveraging npm package distribution to steal arbitrary files from users' systems.
The glyphmatrix-fixture npm package versions 1.0.0 and 1.0.1 contain malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removal of the package alone may not eliminate the malicious software, as the attacker may have gained full control of the system.
The trajmetrics package version 0.5.3 on PyPI contains malicious code that scans the entire system to exfiltrate selected file types. When used as instructed in its README, it runs a background process that continuously monitors and exfiltrates files as they change, indicating clear malicious intent as an infostealer.
The npm package 'csec-form-validatorr' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The ccsseecc-form-validator npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different computer are strongly advised.
The ccsseecc-crypto-toolkit npm package contains malicious code that fully compromises any computer on which it is installed or running. It can lead to complete control by an outside entity, risking all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different computer are strongly advised.
The npm package ccsec-form-validator contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee eradication of the malicious software or attacker control.
The ccsec-crypto-toolkit npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The csec-form-validator npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The csec-crypto-toolkit npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have gained full control of the system.
The npm package 'agentenact' version 0.2.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The dsh-vm-tester npm package versions 0.1.2, 0.1.3, and 0.1.4 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious components, as the attacker may have established persistent control.
@webapp-shared/login-vmok is a malicious npm package designed for dependency confusion attacks. It impersonates an internal scoped package and was published with multiple versions containing a postinstall script that sends sensitive host information to a remote server over unencrypted HTTP. The package also sends this data whenever it is loaded, disclosing internal hostnames and filesystem paths to an attacker-controlled endpoint. Placeholder versions without malicious code exist but are not affected.
The numprint package on PyPI version 1.2.0 contains malicious code that executes during installation. It starts a background process that runs commands from an attacker via communication through a GitHub Gist. This behavior indicates the package is used as a remote access trojan (RAT) to execute attacker-provided commands on the victim's machine.
The adyen-web-v6 npm package contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, necessitating immediate rotation of all secrets and keys from a separate, secure machine. Removal of the package alone may not eliminate all malicious software introduced by it.
The npm package 'buttoncontent' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean machine. Removing the package alone may not fully remove the malicious software or restore system integrity.