The npm package 'jshelperdependenceny' at version 99.0.0 is a malicious package designed to shadow an internal package of the same name. Upon installation, it executes a script that collects host system information and sends it to an attacker-controlled URL. This behavior constitutes a dependency confusion attack and results in potential full system compromise. Immediate removal and secret/key rotation are advised.
The npm package 'sc-hydrate-carousel-price' version 99.9.1 contains malicious code via a dependency on an externally hosted tarball 'ltidisafe' fetched from an untrusted URL without integrity checks. Installing this package can lead to full system compromise, as the package functions as a loader for externally controlled code. Immediate removal and secret/key rotation are advised.
The npm package paychex-pdftron@99.9.1 is a malicious package that acts as a stub but declares a sole dependency via an unsecured HTTPS tarball URL. Installing this package causes npm to fetch and execute attacker-controlled code without integrity verification, leading to full system compromise. Any system with this package installed should be considered compromised, and all secrets and keys must be rotated. Removal of the package alone may not eliminate all malicious software.
@ppa-web-components/ppa-headerfooter is a malicious npm package designed as a dependency-confusion probe. It executes a postinstall script and code on import that sends system and environment details to a remote server over unencrypted HTTP. The package exports a Proxy that returns no-op functions, providing no real functionality. This package is part of a set of similarly malicious packages published by the same author, indicating a coordinated attempt to gather information from private build environments.
@ppa-web-components/ppa-hotel-collection is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that exfiltrates system information such as hostname, install path, and working directory to an attacker-controlled server over unencrypted HTTP. The package exports a no-op Proxy to avoid disrupting builds that import the legitimate package. Multiple versions are affected, and the package is part of a broader set of malicious packages published by the same actor.
@ppa-web-components/ppa-banner is a malicious npm package designed as a dependency-confusion trap. It contains a postinstall script and module code that sends system information such as hostname, install path, and working directory in cleartext HTTP to an external IP address. The package exports a no-op Proxy to avoid breaking builds but acts as a beacon to identify internal build environments that mistakenly resolve this public package name. Multiple versions are affected, and the publisher has released similar malicious packages under related scopes.
@ppa-web-components/ppa-builder is a malicious npm package designed for dependency confusion attacks. It contains a postinstall script and runtime code that sends system information to a remote server over unencrypted HTTP. The package exports a Proxy that returns no-op functions to avoid breaking builds while signaling successful installation and execution to an attacker-controlled endpoint. Multiple versions are affected, and the package was published by a malicious actor controlling several similar packages.
@ppa-web-components/ppa-searchform is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that sends host environment details to an external IP address over unencrypted HTTP. The package exports a Proxy that returns no-op functions, providing no legitimate functionality and enabling stealthy reconnaissance. Multiple versions of this package are affected.
@ppa-web-components/ppa-navigation is a malicious npm package designed as a dependency-confusion shim. It contains a postinstall script and runtime code that sends system information to a suspicious external server over plain HTTP. The package exports no-op functions to avoid breaking builds but effectively acts as spyware. Multiple versions are affected, and the publisher has released similar malicious packages under related scopes.
The fontus package versions 0.0.1, 0.0.2, and 0.0.3 on PyPI contain code that likely performs fingerprinting by exfiltrating basic system information such as IP address or username. Analysis found no evidence of more harmful behaviors like executing attacker-controlled payloads, credential theft, or persistence mechanisms. The risk is limited to basic data exfiltration without further malicious activity.
The insta-api-wrapper npm package contains malicious code that captures Instagram credentials and session data, sending them to a hardcoded external server. It also covertly uses the authenticated session to follow and like Instagram accounts and posts chosen by the attacker without user consent. This behavior compromises the security and privacy of any system running the package.
The npm package '@eforms/forms-api' version 2.0.0-SNAPSHOT has been identified as malicious. The package is flagged because it communicates with a domain linked to malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No patch or remediation information is provided.
A criminal group has compromised 953 online stores, mainly Magento shops, by injecting malicious JavaScript loaders into CMS blocks since July 2025. The latest domain used, deepveindrilling.com, employs advanced bot detection via browser fingerprinting to evade scanners. The malicious loader persists by storing code in visitors' localStorage. Attackers exploited known Magento vulnerabilities, including PolyShell and SessionReaper file upload flaws, to gain access. The campaign targets cryptocurrency users with fake Ledger wallet pages. Many stores were reinfected through persistent database access and backdoors, indicating long-term attacker presence despite cleanup efforts.
@drone-js-ext/core is a malicious npm package designed for dependency confusion attacks. It impersonates an internal package scope and runs a post-install script that sends host-identifying information over unencrypted HTTP to a third-party server. The package also sends this data each time it is loaded and provides no legitimate functionality.
@drone-js-ext/vip-badge is a malicious npm package designed for dependency confusion attacks. It impersonates an internal package scope and contains no legitimate functionality. Upon installation and module load, it sends identifying information about the host machine and environment to a hardcoded external IP address over unencrypted HTTP. This behavior exposes sensitive host details to an uncontrolled third party. The package exports a Proxy that returns no-op functions to hide its lack of functionality. The package is considered fully compromising to any system where it is installed.
The npm package 'tailwind-base-buttons' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as full control of the computer may have been given to an attacker.
The noelc-css-blender npm package contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by this package.
The npm package tailwindcss-theme-kit contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package overarch-windows-x64-yr in versions 1.4.0, 1.5.0, and 2.0.0 is identified as malicious software. Although no direct malicious behaviors such as reading secrets, executing remote code, or opening backdoors were detected during installation or import, the package is considered fully compromising any computer on which it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different computer are strongly advised.
The npm package @liauto/win32-x64 version 0.1.2-b2 is identified as malicious software. Although it is a platform-specific package with a small file set and no observed install-time execution or network activity, its presence indicates a full system compromise. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system should be rotated immediately. Removal of the package alone may not eliminate all malicious components due to potential persistence or additional malware installed.