The npm package 'publish-poc-test3' contains malicious code in its postinstall script that creates a temporary directory with a fabricated package.json and executes an obfuscated 'npm publish' command. This command publishes a new attacker-named package to the public npm registry using the installer's npm authentication credentials. This behavior enables credential abuse and self-propagation of malicious packages under the victim's identity.
@apexacc/cli is a malicious npm package distributed by a fake Web3 accelerator that repackages a legitimate coding agent with added malware. It hijacks AI model traffic to attacker infrastructure, persists a remote control server, and defaults tool approvals to unsafe settings. On Windows, it attempts to weaken system security by disabling Smart App Control and adding Defender exclusions via an elevated PowerShell process, then downloads and executes a large unverified binary that acts as an infostealer. On macOS, it drops a fake password prompt for credential theft and command-and-control. All known versions are affected, and the malicious package remains live on npm as of the last analysis date.
The numbors npm package version 1.6.1 contains heavily obfuscated JavaScript code that prevents clear understanding of its behavior. Although no direct evidence of malicious actions such as credential theft or command-and-control communication was found, the obfuscation hinders verification of its safety. Security sources warn that any system with this package installed should be considered fully compromised, recommending immediate secret and key rotation and removal of the package.
The npm package 'dsh-native' version 1.4.1 contains malicious code that can fully compromise any computer on which it is installed or running. The compromise potentially exposes all stored secrets and keys, which should be rotated immediately from a different machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package util-foriepft@1.0.0 contains malicious code that executes system commands to collect host information and sends this data to a remote server. The package masquerades as a utility helper but includes a module that runs reconnaissance commands and exfiltrates data to an external collector. This behavior indicates a compromise of any system where the package is installed.
The npm package css-grid-snap-util versions 1.0.0 and 1.0.1 contains a stub module and a manifest referencing a webhook.site endpoint. Although the package code does not currently execute outbound network behavior, it is identified as a malicious package. Systems with this package installed should be considered fully compromised, and all secrets and keys on those systems should be rotated immediately. Removal of the package alone may not eliminate all malicious software.
The npm package @regex33-hackerone/tb-compat version 1.0.0 is identified as malicious software. Despite scans showing no detected malicious behavior in the package files themselves, the presence of this package on any computer indicates a full system compromise. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised machine. There is no guarantee that removing the package will eliminate all malicious software resulting from its installation.
@walknpm/todo-cli version 2.0.1 is a malicious npm package release that includes a postinstall script executing a hidden cryptominer. The script downloads and runs a payload that installs an XMRig Monero miner and helper daemons with persistence mechanisms such as systemd units or cron jobs. This results in unauthorized remote code execution, resource theft, and a difficult-to-remove infection on the host system.
The npm package dsh-plugin-blender-3d version 0.2.1 contains a malicious postinstall script that downloads and executes a payload installing an XMRig cryptocurrency miner and persistent backdoors. The malware installs systemd units or cron jobs for persistence and mines Monero using a hardcoded wallet. If run with root or passwordless sudo, it achieves full persistent agent installation with stealthy system-component-like binaries and relay/tor channels. The package is considered fully compromising to any host where installed.
Since September 15, 2026, the Gheist campaign has been abusing stolen GitHub tokens to commit a malicious workflow named sync-check to accessible repositories. This workflow attempts to print repository secrets into logs, which are then exfiltrated via GitHub's API before the logs are deleted. The campaign has affected over 850 compromised accounts and more than 13,500 planted branches, impacting both personal and enterprise private repositories. GitHub's approval controls have prevented exploitation in public repositories, but private and enterprise repositories remain vulnerable. The campaign operates without a command-and-control server, uses the user agent 'gheist', and has multiple evolving variants. Approximately two-thirds of affected accounts have been removed by GitHub, likely as a response measure.
The canta-baileys npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package birch-css-utils, advertised as a zero-runtime CSS theme kit for Tailwind, contains heavily obfuscated JavaScript code that executes on import. This code includes AWS Sigv4 signing primitives and AWS Access Key ID patterns, indicating it is designed to steal AWS credentials from users who import the package. The package's README falsely denies runtime JavaScript, misleading users. Installation or use of this package can lead to full system compromise and credential theft.
The claudeopuseni package on PyPI is a malicious Python package that executes attacker-controlled code upon import. It attempts to fetch encrypted payloads from a remote server, decrypts them, and executes them, falling back to a bundled payload if the server is unreachable. The package includes sandbox evasion techniques and runs with the importing user's privileges. During installation, it also uses obfuscated code and steganography to deploy a native extension infostealer that exfiltrates sensitive data to a command-and-control server via the Polygon blockchain. The package name mimics a legitimate product to lure victims.
The claudeopusfile package on PyPI contains malicious code that executes an obfuscated payload during installation. The code uses techniques to hide execution from scanners and includes kill switches to evade sandbox environments. It downloads and runs a staged second payload with installer privileges, which acts as an infostealer exfiltrating sensitive data to a command-and-control server via the Polygon blockchain. The package's advertised functionality does not justify this behavior.
The nebulallm package on PyPI version 1.4.3 is a malicious typosquatting package that executes harmful code during installation. It overrides the install command in setup.py to download and run a JScript script, which subsequently downloads a malicious DLL. This behavior clearly indicates malware intent.
The PyPI package 'zagents-message-bus' contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in its setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The npm package '@capsense/ccx-welcome-page' version 99.99.100 has been identified as malicious due to its communication with a domain linked to malicious activity. This behavior classifies the package as a security threat.
The npm package '@capsense/core-ui' version 99.99.100 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided.
The w-mousekey npm package versions 1.0.41 and 1.0.42 contain malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
This report analyzes Hermes, an active malware-as-a-service platform operating in the Russian cybercrime market, along with its PyMapper distribution chain. The analysis is based on a detailed technical report authored by a researcher and publicly available. The platform facilitates malware distribution and service offerings typical of malware-as-a-service ecosystems. No specific software vulnerabilities or exploits are detailed in the provided information.