The npm package 'string-target-mapper-hash' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software, as the attacker may have gained full control of the system.
The npm package 'macro-kernel-record-reader' is identified as containing malicious code. Any system with this package installed or running is considered fully compromised, potentially allowing an attacker full control over the computer. Immediate rotation of all secrets and keys stored on the affected system is recommended, using a different, uncompromised machine. Removal of the package is advised, but it may not fully eliminate the malicious presence due to possible persistent backdoors or additional malware installed.
The npm package 'fetch-hash-cache-atomic' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, trusted machine. Removal of the package alone is insufficient to guarantee the elimination of all malicious software introduced by this package.
The npm package '@azure-growth/signup-ux-components' version 1.2.2 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain linked to malicious activity. There is no CVSS score or detailed technical impact provided. No known exploits in the wild have been reported.
The npm package @camera.ui/camera-ui-nvr-windows-amd64 version 1.6.1 contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by it.
The h13t0ry-hello-demo package on PyPI version 0.1.0 contains malicious code that initiates a reverse shell upon import. This behavior allows an attacker to execute arbitrary commands on the victim's machine, posing a significant security risk.
The kafbail npm package versions 2.0.12, 2.0.13, and 2.0.14 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The zero2-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control over the system.
The npm package @exclipz/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The @exclipz/bails npm package contains malicious code that can fully compromise any computer on which it is installed or running. Due to the potential for complete system takeover, all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
The npm package 'justinofficial' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by it.
The npm package 'aytidaoffc' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The nuxzofficial package on npm contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package @nuxzofficial/baileys contains malicious code that can fully compromise any computer on which it is installed or running. This compromise potentially allows an attacker full control over the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, simply removing the package may not eliminate all malicious software. All secrets and keys stored on the compromised computer should be rotated immediately from a separate, secure device.
The npm package ctf-agent version 0.1.0 is identified as malicious. Although detailed static analysis found no direct evidence of credential theft, remote code execution, or backdoors, the package is considered fully compromising any system on which it is installed. Systems with this package should be treated as fully compromised, and all stored secrets and keys must be rotated from a clean environment. Removal of the package alone does not guarantee eradication of all malicious components.
The npm package csvflow-schema version 1.0.0 was found to contain malicious code in its postinstall script. This script collects local system information, writes it to a temporary file, launches the Windows calculator application, and sends an HTTPS request to a hardcoded external domain with a unique install identifier. The package was removed from npm shortly after publication.
The npm package @iobandamwer/native-helper is a malicious package that acts as a temporary placeholder stub but includes an active install-time dropper. It installs a native addon that decodes and executes an opaque payload outside the npm install process. The payload execution is gated to avoid CI environments, containers, and analysis sandboxes. Installing this package on a developer machine results in attacker-controlled code running detached from the installation process, potentially compromising the entire system.
The npm package 'path-stream-utils-testmetest' is a malicious package that includes a native addon executing an opaque payload during installation and runtime. It drops and executes a hidden file in /tmp, evades sandbox and CI environments by detecting various environment indicators, and runs encrypted code not inspectable from the package contents. Installation or use of this package compromises the host system, potentially granting full control to an attacker.
The npm package '@iobandamwer/cache-helper' is a malicious package masquerading as a cache utility. It contains no source code but includes prebuilt native binaries that execute a hidden payload during installation. This payload writes an opaque file to a temporary location, makes it executable, and runs it detached from the install process. The package includes extensive evasion techniques to detect CI environments, sandboxes, debuggers, and containerized environments, indicating it is designed to avoid analysis. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.
The postcss-semantic-themes npm package contains malicious code that executes obfuscated JavaScript modules and includes native binaries performing extensive environment fingerprinting to evade analysis. It masquerades as a CSS theming kit but instead acts as a staged supply-chain malware payload, including brandjacking of the legitimate tailwindcss package name. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.