The npm package harlow-css-mixer version 0.0.0-stage is identified as malicious software. Installation or execution of this package may lead to a full compromise of the affected computer. It does not contain installer secrets or network fetches, but its presence indicates potential unauthorized control. Immediate removal and secret/key rotation are advised to mitigate risks.
The netweavex package on PyPI is a malicious typosquat of the legitimate NetworkX library. It uses a lookalike name and clones the API and module layout to deceive users. Upon import, it executes obfuscated code that decompresses and runs attacker-controlled bytecode, which can download and execute additional malicious scripts. This behavior is characteristic of a PyPI typosquatting dropper designed to compromise the installer's system.
The zagents-framework package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-risk package resembling pentest tools but with a hidden data exfiltration purpose.
The PyPI package 'changes-lxc-wrapper' is a malicious package that exfiltrates basic host information such as IP address and username upon installation or import. It masquerades under a misleading import namespace 'ca_certificates' that does not match its distribution name. While it does not perform harmful filesystem or network operations beyond data exfiltration, it overrides the install command to execute malicious code during installation.
The @worca/app npm package versions 1.14.0-rc.2 and 1.14.0-rc.4 contain malicious code that can fully compromise any computer on which it is installed or running. The package includes components resembling an egress-control proxy, telemetry channels, and local bridge/UI, with suspicious token co-occurrences detected in multiple core files. Removal of the package alone does not guarantee elimination of all malicious software, and all secrets and keys on the affected machine should be rotated immediately from a separate, trusted device.
The publish-poc-base npm package version 1.0.7 contains malicious code in its postinstall script. This script reads the first line of a README.md file from the installer's parent workspace, creates a temporary directory, and writes a new package.json and an .npmrc file containing a hardcoded npm registry authentication token. Although the package does not execute a publish step itself, it distributes a live third-party-usable publish credential in cleartext to all installers and harvests local README content at install time, raising significant supply-chain security concerns.
The npm package 'publish-poc-test3' contains malicious code in its postinstall script that creates a temporary directory with a fabricated package.json and executes an obfuscated 'npm publish' command. This command publishes a new attacker-named package to the public npm registry using the installer's npm authentication credentials. This behavior enables credential abuse and self-propagation of malicious packages under the victim's identity.
@apexacc/cli is a malicious npm package distributed by a fake Web3 accelerator that repackages a legitimate coding agent with added malware. It hijacks AI model traffic to attacker infrastructure, persists a remote control server, and defaults tool approvals to unsafe settings. On Windows, it attempts to weaken system security by disabling Smart App Control and adding Defender exclusions via an elevated PowerShell process, then downloads and executes a large unverified binary that acts as an infostealer. On macOS, it drops a fake password prompt for credential theft and command-and-control. All known versions are affected, and the malicious package remains live on npm as of the last analysis date.
The numbors npm package version 1.6.1 contains heavily obfuscated JavaScript code that prevents clear understanding of its behavior. Although no direct evidence of malicious actions such as credential theft or command-and-control communication was found, the obfuscation hinders verification of its safety. Security sources warn that any system with this package installed should be considered fully compromised, recommending immediate secret and key rotation and removal of the package.
The npm package 'dsh-native' version 1.4.1 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise potentially exposes all stored secrets and keys, which should be rotated immediately from a different machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package util-foriepft@1.0.0 contains malicious code that executes system commands to collect host information and sends this data to a remote server. The package masquerades as a utility helper but includes a module that runs reconnaissance commands and exfiltrates data to an external collector. This behavior indicates a compromise of any system where the package is installed.
The npm package css-grid-snap-util versions 1.0.0 and 1.0.1 contains a stub module and a manifest referencing a webhook.site endpoint. Although the package code does not currently execute outbound network behavior, it is identified as a malicious package. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately. Removal of the package alone may not eliminate all malicious software.
The npm package @regex33-hackerone/tb-compat version 1.0.0 is identified as malicious software. Despite scans showing no detected malicious behavior in the package files themselves, the presence of this package on any computer indicates a full system compromise. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised machine. There is no guarantee that removing the package will eliminate all malicious software resulting from its installation.
@walknpm/todo-cli version 2.0.1 is a malicious npm package release that includes a postinstall script executing a hidden cryptominer. The script downloads and runs a payload that installs an XMRig Monero miner and helper daemons with persistence mechanisms such as systemd units or cron jobs. This results in unauthorized remote code execution, resource theft, and a difficult-to-remove infection on the host system.
The npm package dsh-plugin-blender-3d version 0.2.1 contains a malicious postinstall script that downloads and executes a payload installing an XMRig cryptocurrency miner and persistent backdoors. The malware installs systemd units or cron jobs for persistence and mines Monero using a hardcoded wallet. If run with root or passwordless sudo, it achieves full persistent agent installation with stealthy system-component-like binaries and relay/tor channels. The package is considered fully compromising to any host where installed.
The canta-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package birch-css-utils, advertised as a zero-runtime CSS theme kit for Tailwind, contains heavily obfuscated JavaScript code that executes on import. This code includes AWS Sigv4 signing primitives and AWS Access Key ID patterns, indicating it is designed to steal AWS credentials from users who import the package. The package's README falsely denies runtime JavaScript, misleading users. Installation or use of this package can lead to full system compromise and credential theft.
The claudeopuseni package on PyPI is a malicious Python package that executes attacker-controlled code upon import. It attempts to fetch encrypted payloads from a remote server, decrypts them, and executes them, falling back to a bundled payload if the server is unreachable. The package includes sandbox evasion techniques and runs with the importing user's privileges. During installation, it also uses obfuscated code and steganography to deploy a native extension infostealer that exfiltrates sensitive data to a command-and-control server via the Polygon blockchain. The package name mimics a legitimate product to lure victims.
The claudeopusfile package on PyPI contains malicious code that executes an obfuscated payload during installation. The code uses techniques to hide execution from scanners and includes kill switches to evade sandbox environments. It downloads and runs a staged second payload with installer privileges, which acts as an infostealer exfiltrating sensitive data to a command-and-control server via the Polygon blockchain. The package's advertised functionality does not justify this behavior.
The nebulallm package on PyPI version 1.4.3 is a malicious typosquatting package that executes harmful code during installation. It overrides the install command in setup.py to download and run a JScript script, which subsequently downloads a malicious DLL. This behavior clearly indicates malware intent.