The PyPI package 'zagents-message-bus' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in its setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The npm package '@capsense/ccx-welcome-page' version 99.99.100 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior classifies the package as a security threat.
The npm package '@capsense/core-ui' version 99.99.100 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided.
The w-mousekey npm package versions 1.0.41 and 1.0.42 contain malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'jshelperdependenceny' at version 99.0.0 is a malicious package designed to shadow an internal package of the same name. Upon installation, it executes a script that collects host system information and sends it to an attacker-controlled URL. This behavior constitutes a dependency confusion attack and results in potential full system compromise. Immediate removal and secret/key rotation are advised.
The npm package @fmr-ap153177/apex-kit-icons version 99.9.1 is a malicious package that declares a dependency on an off-registry tarball URL. Installing this package results in arbitrary code execution due to the unverified external dependency, potentially compromising the entire system. The package acts as a dependency-confusion lure, and any system with it installed should be considered fully compromised.
The npm package '@generic-means/ing-feat-scanner-libs' version 99.9.1 includes a malicious off-registry dependency 'ltidisafe' fetched from an unpinned HTTPS tarball URL. This dependency is not verified through the npm registry and can be swapped by the storage bucket owner, delivering arbitrary code. Installing this package can lead to full system compromise.
The npm package @factoryz/apollo version 99.9.1 is a malicious package that acts as a lure. It contains only an empty stub but declares a dependency on an off-registry tarball fetched via a hardcoded HTTPS URL without integrity checks or version pinning. Installing this package causes arbitrary code execution from the fetched tarball, potentially compromising the host system. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated immediately. Removal of the package alone does not guarantee elimination of all malicious software.
The npm package @jm-telefonica/multibrand-components version 99.9.1 contains malicious code delivered via a dependency on an unpinned tarball URL. Installing this package executes arbitrary code controlled by an attacker, potentially compromising the entire system. The package's index.js is a stub, with the malicious payload residing in the dependency URL. This is a dependency confusion attack targeting Telefónica's internal namespace. Systems with this package installed should be considered fully compromised, and secrets must be rotated immediately.
The npm package @postex/common version 99.9.1 contains a malicious dependency that fetches and executes attacker-controlled code from an off-registry URL. Installing this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
The npm package 'sc-hydrate-carousel-price' version 99.9.1 contains malicious code via a dependency on an externally hosted tarball 'ltidisafe' fetched from an untrusted URL without integrity checks. Installing this package can lead to full system compromise, as the package functions as a loader for externally controlled code. Immediate removal and secret/key rotation are advised.
The npm package @futurae-public/adaptive-js version 99.9.1 contains malicious code through a dependency fetched from an off-registry HTTPS tarball URL. This dependency fetch bypasses normal npm registry protections, allowing execution of arbitrary code during installation. The package itself is an inert stub, but the off-registry dependency can execute lifecycle scripts, leading to full system compromise. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system must be rotated immediately. Removal of the package does not guarantee removal of all malicious software.
The npm package paychex-pdftron@99.9.1 is a malicious package that acts as a stub but declares a sole dependency via an unsecured HTTPS tarball URL. Installing this package causes npm to fetch and execute attacker-controlled code without integrity verification, leading to full system compromise. Any system with this package installed should be considered compromised, and all secrets and keys must be rotated. Removal of the package alone may not eliminate all malicious software.
@ppa-web-components/ppa-headerfooter is a malicious npm package designed as a dependency-confusion probe. It executes a postinstall script and code on import that sends system and environment details to a remote server over unencrypted HTTP. The package exports a Proxy that returns no-op functions, providing no real functionality. This package is part of a set of similarly malicious packages published by the same author, indicating a coordinated attempt to gather information from private build environments.
@ppa-web-components/ppa-hotel-collection is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that exfiltrates system information such as hostname, install path, and working directory to an attacker-controlled server over unencrypted HTTP. The package exports a no-op Proxy to avoid disrupting builds that import the legitimate package. Multiple versions are affected, and the package is part of a broader set of malicious packages published by the same actor.
@ppa-web-components/ppa-banner is a malicious npm package designed as a dependency-confusion trap. It contains a postinstall script and module code that sends system information such as hostname, install path, and working directory in cleartext HTTP to an external IP address. The package exports a no-op Proxy to avoid breaking builds but acts as a beacon to identify internal build environments that mistakenly resolve this public package name. Multiple versions are affected, and the publisher has released similar malicious packages under related scopes.
@ppa-web-components/ppa-builder is a malicious npm package designed for dependency confusion attacks. It contains a postinstall script and runtime code that sends system information to a remote server over unencrypted HTTP. The package exports a Proxy that returns no-op functions to avoid breaking builds while signaling successful installation and execution to an attacker-controlled endpoint. Multiple versions are affected, and the package was published by a malicious actor controlling several similar packages.
@ppa-web-components/ppa-searchform is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that sends host environment details to an external IP address over unencrypted HTTP. The package exports a Proxy that returns no-op functions, providing no legitimate functionality and enabling stealthy reconnaissance. Multiple versions of this package are affected.
@ppa-web-components/ppa-navigation is a malicious npm package designed as a dependency-confusion shim. It contains a postinstall script and runtime code that sends system information to a suspicious external server over plain HTTP. The package exports no-op functions to avoid breaking builds but effectively acts as spyware. Multiple versions are affected, and the publisher has released similar malicious packages under related scopes.
The fontus package versions 0.0.1, 0.0.2, and 0.0.3 on PyPI contain code that likely performs fingerprinting by exfiltrating basic system information such as IP address or username. Analysis found no evidence of more harmful behaviors like executing attacker-controlled payloads, credential theft, or persistence mechanisms. The risk is limited to basic data exfiltration without further malicious activity.