@greenlake/context-pane is a malicious npm package designed as a dependency-confusion lure. It contains a postinstall script and runtime code that send system information to a suspicious external server over unencrypted HTTP. The package exports no functional code, only no-op proxies to avoid breaking dependent builds. Multiple similar packages were published by the same author under various scopes, all exhibiting identical malicious behavior.
@greenlake/common-context is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that silently collects and sends sensitive environment information, including hostname, install path, and working directory, to an external server over plain HTTP. The package exports an inert Proxy to avoid breaking builds but leaks internal details to an attacker-controlled endpoint. Multiple versions are affected, and the package is part of a set published by the same actor under various scopes.
@greenlake/auth is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that sends system information (hostname, install path, working directory, Node version) over plain HTTP to an attacker-controlled server. The package exports a no-op Proxy to avoid breaking builds but effectively compromises any system that installs or imports it.
A vulnerability in @rog0x/mcp-docker-tools version 1.0.1 allows remote attackers to execute arbitrary code via the handleImageList function. This issue has a high severity with a CVSS score of 7.5. The vulnerability requires user interaction and has a high attack complexity. No affected versions beyond 1.0.1 are explicitly stated, and no patch or remediation information is provided.
CVE-2026-106763 is a high-severity vulnerability in @justice8096/sagemath-mcp-server version 1.0.1 that allows a remote attacker to execute arbitrary code via the escapeShellString and sanitizeCode functions. The vulnerability requires no privileges and has a high impact on confidentiality, integrity, and availability. No patch or remediation information is currently provided.
A vulnerability in @rog0x/mcp-git-tools version 1.0.1 allows a remote attacker to execute arbitrary code via the resolveBaseBranch function. This issue has a high severity rating with a CVSS score of 7.5. The vulnerability requires high attack complexity and no privileges but involves user interaction. No patch or remediation information is provided.
The npm package 'skillward' versions 0.1.1 and 0.1.2 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise may lead to unauthorized access and control by an outside entity. Immediate removal of the package is recommended, but due to the potential full system compromise, simply removing the package may not eliminate all malicious components. All secrets and keys stored on the affected computer should be rotated from a different, secure machine.
The @grabcad/preferences-client npm package is a malicious package that acts as a dependency confusion attack vector. It exports a Proxy that returns no-op functions but executes a beacon script on import and post-install, sending sensitive environment information to an attacker-controlled server. This reconnaissance behavior discloses internal hostnames, install paths, and Node.js version to a hostile endpoint. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately from a different machine.
The npm package @grabcad/company-server-shared is a malicious placeholder package used in a dependency-confusion attack. It exports no real functionality but runs a post-install script and code on require that sends internal system information to an attacker-controlled IP address over plain HTTP. This includes hostname, installation path, current working directory, and Node/npm version. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
The @cecm-web-sdk/core npm package contains malicious code that executes a postinstall script sending sensitive environment details to a remote IP address. The package exports a Proxy with no-op functions but triggers network beaconing on install and import, potentially exposing internal hostnames and project paths. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @blueskydataplatform/shared-ui contains malicious code that collects host identifiers and sends them in cleartext to a hardcoded external IP address. The beacon runs automatically during installation and when the package is imported, with no legitimate functionality. This behavior indicates the package is designed to report successful installation to an external operator, consistent with dependency confusion or namespace squatting attacks. Systems with this package installed should be considered fully compromised.
The npm package @tekmidian/pai versions 1.0.8, 1.0.9, and 1.0.10 contains malicious code. Although the codebase includes references to shell commands and base64 decoding, no direct evidence links these to active exfiltration or execution flows. However, the package is flagged as malware by a security source, indicating that any system with this package installed should be considered fully compromised. Immediate removal and secret/key rotation are recommended.
The npm package @factiii/runner contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but due to potential full control by an attacker, complete remediation may require additional measures such as rotating all secrets from a different, uncompromised system.
The npm package @seggy116/next-diff version 0.3.0 is identified as malicious. Although some analysis suggests the bundled UI code contains typical 'ping' tokens without direct evidence of exfiltration or credential theft, another source strongly indicates that any system with this package installed should be considered fully compromised. Immediate secret and key rotation is advised, and removal of the package is recommended, though complete remediation may require further system cleansing due to potential full control by an attacker.
The npm package @pkgship/frps-linux-amd64 version 0.71.1 is identified as malicious. It distributes a platform-specific binary for Linux AMD64 that is consistent with the frp reverse-proxy server, but the package is considered malware. Although no install-time execution or network behavior was observed in the initial inspection, the package is flagged as fully compromising any system where it is installed or running. Immediate secret and key rotation is recommended, and removal of the package is advised, but full remediation may require additional measures due to potential persistent compromise.
The npm package @pkgship/frpc-linux-amd64 version 0.71.1 contains malicious code. Although it ships a prebuilt binary without suspicious lifecycle scripts or network activity during installation, the package is identified as malware. Any system with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation and package removal. However, removal may not guarantee complete eradication of malicious software.
The npm package sdk-utils-testmetest version 1.0.0 is identified as malicious software. Although the package itself does not exhibit install-time execution or network activity, its installation compromises the host computer fully. Any secrets or keys stored on the compromised machine should be rotated immediately from a separate, secure device. Removal of the package alone may not eliminate all malicious components due to potential full system compromise.
The npm package @lumen-labs-dev/whisper-node version 0.5.1 is identified as malicious. Installation of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised device is strongly advised.
The darknode-cli npm package versions 2.46.0, 2.46.1, and 2.46.2 contain malicious code that functions as an offensive-security and penetration testing toolkit. While the package does not automatically execute upon installation or exfiltrate installer-side data, it exposes local HTTP control surfaces and includes modules that catalog offensive tools and sensitive file indicators. The package's capabilities are directed at operator-chosen external targets. According to one source, any system with this package installed or running should be considered fully compromised, and all stored secrets and keys should be rotated immediately.
The npm package x402-prompt-injection-scan version 0.1.4 is identified as malicious software. Although static and behavioral scans did not detect typical malicious behaviors such as network communication or credential harvesting, the package is considered fully compromising to any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised system is strongly advised.