@ppa-web-components/ppa-banner is a malicious npm package designed as a dependency-confusion trap. It contains a postinstall script and module code that sends system information such as hostname, install path, and working directory in cleartext HTTP to an external IP address. The package exports a no-op Proxy to avoid breaking builds but acts as a beacon to identify internal build environments that mistakenly resolve this public package name. Multiple versions are affected, and the publisher has released similar malicious packages under related scopes.
@ppa-web-components/ppa-builder is a malicious npm package designed for dependency confusion attacks. It contains a postinstall script and runtime code that sends system information to a remote server over unencrypted HTTP. The package exports a Proxy that returns no-op functions to avoid breaking builds while signaling successful installation and execution to an attacker-controlled endpoint. Multiple versions are affected, and the package was published by a malicious actor controlling several similar packages.
@ppa-web-components/ppa-searchform is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that sends host environment details to an external IP address over unencrypted HTTP. The package exports a Proxy that returns no-op functions, providing no legitimate functionality and enabling stealthy reconnaissance. Multiple versions of this package are affected.
@ppa-web-components/ppa-navigation is a malicious npm package designed as a dependency-confusion shim. It contains a postinstall script and runtime code that sends system information to a suspicious external server over plain HTTP. The package exports no-op functions to avoid breaking builds but effectively acts as spyware. Multiple versions are affected, and the publisher has released similar malicious packages under related scopes.
The insta-api-wrapper npm package contains malicious code that captures Instagram credentials and session data, sending them to a hardcoded external server. It also covertly uses the authenticated session to follow and like Instagram accounts and posts chosen by the attacker without user consent. This behavior compromises the security and privacy of any system running the package.
The npm package '@eforms/forms-api' version 2.0.0-SNAPSHOT has been identified as malicious. The package is flagged because it communicates with a domain linked to malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided.
@drone-js-ext/core is a malicious npm package designed for dependency confusion attacks. It impersonates an internal package scope and runs a post-install script that sends host-identifying information over unencrypted HTTP to a third-party server. The package also sends this data each time it is loaded and provides no legitimate functionality.
@drone-js-ext/vip-badge is a malicious npm package designed for dependency confusion attacks. It impersonates an internal package scope and contains no legitimate functionality. Upon installation and module load, it sends identifying information about the host machine and environment to a hardcoded external IP address over unencrypted HTTP. This behavior exposes sensitive host details to an uncontrolled third party. The package exports a Proxy that returns no-op functions to hide its lack of functionality. The package is considered fully compromising to any system where it is installed.
The npm package 'tailwind-base-buttons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as full control of the computer may have been given to an attacker.
The noelc-css-blender npm package contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by this package.
The npm package tailwindcss-theme-kit contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package overarch-windows-x64-yr in versions 1.4.0, 1.5.0, and 2.0.0 is identified as malicious software. Although no direct malicious behaviors such as reading secrets, executing remote code, or opening backdoors were detected during installation or import, the package is considered fully compromising any computer on which it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different computer are strongly advised.
The npm package @liauto/win32-x64 version 0.1.2-b2 is identified as malicious software. Although it is a platform-specific package with a small file set and no observed install-time execution or network activity, its presence indicates a full system compromise. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately. Removal of the package alone may not eliminate all malicious components due to potential persistence or additional malware installed.
@sxm-web/client-sdk-core is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that sends system information such as hostname, install path, and working directory in cleartext to a remote server. The package exports a Proxy that returns no-op functions, providing no legitimate functionality. Multiple versions of this package have been published under various scopes by the same malicious actor.
@k18k/entrypoint-sdk-darwin-arm64 is a malicious npm package targeting the darwin-arm64 platform. Installation or execution of this package compromises the host computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised device is strongly advised.
The orqiva-runtime-win32-x64 npm package version 0.1.0 is identified as malicious software. Installation or execution of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised system is strongly advised.
The npm package @k18k/entrypoint-sdk-linux-x64 versions 0.2.0 and 0.2.1 contain malicious code. Installation or execution of this package can lead to full system compromise. Users should consider any system with this package installed as fully compromised and rotate all secrets and keys from a different machine. Removal of the package does not guarantee removal of all malicious software introduced.
The npm package @k18k/entrypoint-sdk-darwin-x64 versions 0.2.0 and 0.2.1 contain malicious code. Although the package does not exhibit typical installer script behaviors or network activity, its presence on a system indicates a full compromise. Any secrets or keys stored on the affected computer should be rotated immediately. Removing the package alone may not eliminate all malicious software introduced by its installation.
@greenlake/session is a malicious npm package designed as a dependency-confusion attack. It contains a postinstall script and runtime code that sends host identifiers and environment details over unencrypted HTTP to a suspicious external IP address. The package exports a Proxy that disables normal functionality, effectively acting as a beacon to exfiltrate data. Multiple versions are affected, and the package was published by an account that released several similar malicious packages.
@greenlake/mfe-login-url is a malicious npm package designed as a dependency-confusion test but actually exfiltrates host metadata. It contains a postinstall script and runtime code that sends the hostname, install path, current working directory, and Node version to a hardcoded HTTP endpoint. The package exports a Proxy that returns no-op functions to avoid breaking builds while silently confirming successful installs and disclosing host identifiers to an unknown operator. Multiple versions are affected, and the package is part of a set of similar malicious packages published by the same npm account.