The npm package 'automic-style-engine' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The hello-bat-fwi9 package on PyPI contains an obfuscated batch (.bat) file that delivers a Remote Access Trojan (RAT) using its own Python runtime and PTH files. The malicious code requires manual activation to execute. This package is part of a known malicious campaign identified as 2026-11-hello-bat-fwi9, continuing a previous campaign named 2026-11-filipt.
The monobomber npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all resulting malicious software, as the attacker may have gained full control of the system.
The npm package 'monopw' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets from a different, secure computer is strongly advised.
The npm package 'tw-motion-css' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone does not guarantee elimination of the malicious software or attacker control.
The npm package 'wisdomtreetest' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer is strongly advised. However, removal of the package alone may not eliminate all malicious software introduced by it.
The npm package '@ts-expect-error/n' contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by the package.
The npm package '@site-cms/ssr' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Simply removing the package may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The @sideeffects/n npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software or control established by the attacker.
The npm package @noinheritdoc/n contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package does not guarantee elimination of all malicious software introduced by the package.
The npm package @needsaudit/nexport contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @needsaudit/n contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removal of the package alone does not guarantee eradication of the malicious software, as full control may have been given to an external attacker.
The @smart-dev-wa/baileys npm package version 1.0.0 contains malicious code that automatically subscribes the user's authenticated WhatsApp account to a specific WhatsApp Channel without user consent. This behavior contradicts the package's README claim of no auto-follow functionality. The malicious action occurs when an application using this library creates a WhatsApp socket connection. No credentials or session keys are exfiltrated, and no install-time payload or persistence mechanisms are present. The primary harm is unauthorized use of the victim's account to inflate subscriber counts for the attacker's chosen channels.
The zero2-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control over the system.
The arc-contracts npm package contains malicious code that compromises any computer on which it is installed or running. This compromise potentially grants full control to an outside entity, risking exposure of all secrets and keys stored on the affected system. Immediate removal of the package and rotation of all secrets from a different, uncompromised machine is strongly advised.
The npm package 'kc-kline-chart' contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is advised, but due to the extent of the compromise, complete remediation cannot be guaranteed by removal alone.
The securedrop-app npm package contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, uncompromised device. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The evmos-contracts npm package contains malicious code that compromises any computer on which it is installed or running. Systems affected by this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee the removal of all malicious software introduced by it.
Armorsteal is a Python-based malware kit that steals sensitive data and mines cryptocurrency. It persists on infected Windows systems by installing in a hidden directory and creating scheduled tasks. The malware uses obfuscation and sandbox evasion techniques and includes modules for backdoor access, cryptocurrency mining, keystroke logging, clipboard manipulation, and credential theft from browsers, Discord, wallets, and password managers. It uses multiple command-and-control domains and disables Windows Defender to avoid detection.
This intelligence analysis covers a malicious campaign deploying Remcos RAT, a commercially available remote access trojan. The infection starts with a weaponized Excel spreadsheet that uses VBA macros to execute PowerShell commands, which then download additional malicious scripts from attacker-controlled domains. The multi-stage attack culminates in the deployment of the Remcos RAT payload. The campaign uses social engineering with financial-themed lures to trick victims into enabling macros, facilitating the infection. Command and control infrastructure involves domains dvrlists[.]com and lbl[.]support.