@sxm-web/client-sdk-core is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that sends system information such as hostname, install path, and working directory in cleartext to a remote server. The package exports a Proxy that returns no-op functions, providing no legitimate functionality. Multiple versions of this package have been published under various scopes by the same malicious actor.
@k18k/entrypoint-sdk-darwin-arm64 is a malicious npm package targeting the darwin-arm64 platform. Installation or execution of this package compromises the host computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised device is strongly advised.
The orqiva-runtime-win32-x64 npm package version 0.1.0 is identified as malicious software. Installation or execution of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised system is strongly advised.
The npm package @k18k/entrypoint-sdk-linux-x64 versions 0.2.0 and 0.2.1 contain malicious code. Installation or execution of this package can lead to full system compromise. Users should consider any system with this package installed as fully compromised and rotate all secrets and keys from a different machine. Removal of the package does not guarantee removal of all malicious software introduced.
The npm package @k18k/entrypoint-sdk-darwin-x64 versions 0.2.0 and 0.2.1 contain malicious code. Although the package does not exhibit typical installer script behaviors or network activity, its presence on a system indicates a full compromise. Any secrets or keys stored on the affected computer should be rotated immediately. Removing the package alone may not eliminate all malicious software introduced by its installation.
@greenlake/session is a malicious npm package designed as a dependency-confusion attack. It contains a postinstall script and runtime code that sends host identifiers and environment details over unencrypted HTTP to a suspicious external IP address. The package exports a Proxy that disables normal functionality, effectively acting as a beacon to exfiltrate data. Multiple versions are affected, and the package was published by an account that released several similar malicious packages.
@greenlake/mfe-login-url is a malicious npm package designed as a dependency-confusion test but actually exfiltrates host metadata. It contains a postinstall script and runtime code that sends the hostname, install path, current working directory, and Node version to a hardcoded HTTP endpoint. The package exports a Proxy that returns no-op functions to avoid breaking builds while silently confirming successful installs and disclosing host identifiers to an unknown operator. Multiple versions are affected, and the package is part of a set of similar malicious packages published by the same npm account.
@greenlake/context-pane is a malicious npm package designed as a dependency-confusion lure. It contains a postinstall script and runtime code that send system information to a suspicious external server over unencrypted HTTP. The package exports no functional code, only no-op proxies to avoid breaking dependent builds. Multiple similar packages were published by the same author under various scopes, all exhibiting identical malicious behavior.
@greenlake/common-context is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that silently collects and sends sensitive environment information, including hostname, install path, and working directory, to an external server over plain HTTP. The package exports an inert Proxy to avoid breaking builds but leaks internal details to an attacker-controlled endpoint. Multiple versions are affected, and the package is part of a set published by the same actor under various scopes.
@greenlake/auth is a malicious npm package designed as a dependency-confusion probe. It contains a postinstall script and runtime code that sends system information (hostname, install path, working directory, Node version) over plain HTTP to an attacker-controlled server. The package exports a no-op Proxy to avoid breaking builds but effectively compromises any system that installs or imports it.
LiteLLM version 1.107.0 was compromised and distributed via PyPI and official container images on October 21, 2026. The malicious package used Python startup hooks to automatically execute credential-stealing payloads without requiring explicit import of LiteLLM. Attackers stole developer GitHub credentials to redirect release workflows to a fake repository. The payload targeted authentication credentials across developer tools, AI applications, cloud environments, browsers, and infrastructure. Credentials were encrypted and exfiltrated to attacker-controlled servers. The compromise affected developer workstations, CI/CD agents, test systems, containers, and LiteLLM gateway deployments where Python was executed.
The PyPI package 'sitecard' versions 0.1.0 through 0.1.14 contains malicious code that creates an SSH session exposed via tunnels. This session is accessible without any authentication by default and reports to a hardcoded location, effectively acting as a backdoor. This exposes users to unauthorized remote access by attackers.
Aokigahara is an infostealer malware targeting traditional data sources such as browsers, VPN clients, cryptocurrency wallets, FTP/SFTP clients, password managers, and email applications. It uniquely targets AI applications and development tools, stealing authentication files, session data, and configuration files from services like Claude, ChatGPT Desktop, Codex, and GitHub Copilot. It also collects developer credentials including Git files, SSH private keys, and cloud service credentials (AWS, Azure, Google Cloud). The stolen AI credentials may be used for unauthorized access, account resale, or data extortion. The malware uses anti-analysis techniques and secures its command-and-control communications with AES-256 encryption and X25519 key exchange.
The jobwharf package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the payload themselves but facilitate downloading and running malicious scripts. The campaign is coordinated and intended to deceive users into executing harmful code.
The PyPI package 'slatejob' version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. Although the package itself does not contain the payload, it acts as a delivery mechanism for potentially harmful code. This coordinated campaign aims to provide multiple deceptive methods to load malicious code remotely.
The reedworker package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the malicious payload themselves but are designed to download and run remote malicious scripts, indicating a coordinated effort to facilitate malicious code execution.
The loadferry package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external sources.
The runpier package on PyPI version 0.1.0 is part of a coordinated campaign involving multiple loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the payload, its functionality enables execution of potentially harmful code from external sources. This campaign is identified as malicious with intent similar to infostealers.
The sedgehaul package on PyPI version 0.1.0 is part of a coordinated malicious campaign involving loader packages that download and execute remote malicious scripts. These packages do not contain the payload themselves but serve as deceptive loaders to facilitate malicious code execution. The campaign is identified as having clear malicious intent, including potential infostealing activities.
The taskquay package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. While the packages themselves do not contain the payload, their coordinated use facilitates executing harmful code from external sources. This campaign is identified as having clear malicious intent, such as infostealing.