The @smart-dev-wa/baileys npm package version 1.0.0 contains malicious code that automatically subscribes the user's authenticated WhatsApp account to a specific WhatsApp Channel without user consent. This behavior contradicts the package's README claim of no auto-follow functionality. The malicious action occurs when an application using this library creates a WhatsApp socket connection. No credentials or session keys are exfiltrated, and no install-time payload or persistence mechanisms are present. The primary harm is unauthorized use of the victim's account to inflate subscriber counts for the attacker's chosen channels.
The zero2-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control over the system.
The arc-contracts npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised.
The npm package 'kc-kline-chart' contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, complete remediation cannot be guaranteed by removal alone.
The securedrop-app npm package contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The evmos-contracts npm package contains malicious code that compromises any computer on which it is installed or running. Systems affected by this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee the removal of all malicious software introduced by it.
The npm package '@kora20030101/test-pkg-delete-me' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but due to the extent of the compromise, complete remediation may require rotating all secrets and keys from a different, uncompromised system.
The npm package @exclipz/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The @exclipz/bails npm package contains malicious code that can fully compromise any computer on which it is installed or running. Due to the potential for complete system takeover, all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
The talk-lang package on npm contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The plain-lang npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised.
The npm package 'test1817' contains malicious code that can fully compromise any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software, as the attacker may have established persistent control.
The @gemshell/win32-x64 npm package version 1.2.1 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package does not guarantee the elimination of all malicious software introduced by it, as full control of the system may have been granted to an attacker.
filecoin-pin versions prior to 1.1.1 have an unbounded DAG pinning vulnerability where the Pinning Service API accepts user-controlled CIDs without enforcing limits on request rate, DAG size, or concurrency. This allows an attacker with authenticated access, or unauthenticated if no-auth mode is enabled, to cause resource exhaustion by recursively fetching large DAGs. The impact includes disk, network, CPU, and memory exhaustion leading to service degradation or failure. The default configuration limits exposure by binding to localhost and requiring an access token unless explicitly disabled. A fix is available in version 1.1.1.
The dsh-purge package version 1.2.1 on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The synapse-hub npm package version 3.1.0 contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an external attacker. Immediate removal of the package and rotation of all secrets and keys stored on the affected system are strongly advised, although removal may not fully eliminate the threat due to possible persistent malicious software.
The npm package @secauditb20y/sec-test-b1 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have established persistent control.
The npm package '@secaudita10x/sec-test-a1' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the severity of the compromise, complete remediation may require rotating all secrets and keys from a different, uncompromised machine.
The dogmans-afterglow npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The npm package 'thththtbhthhth' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee the elimination of all malicious software introduced by it.