The kestreljob package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. These packages do not contain the malicious payload themselves but are designed to download and run remote malicious scripts. This campaign is coordinated and aims to provide multiple deceptive methods to load malicious code.
The npm package 'skillward' versions 0.1.1 and 0.1.2 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise may lead to unauthorized access and control by an outside entity. Immediate removal of the package is recommended, but due to the potential full system compromise, simply removing the package may not eliminate all malicious components. All secrets and keys stored on the affected computer should be rotated from a different, secure machine.
The PyPI package 'onsokets' version 0.1.0 contains malicious code designed for automated file exfiltration, targeting Android devices. This package is part of a campaign identified as 2026-10-proxyrubika, which has clear malicious intent related to information stealing.
The qowa package on PyPI version 0.1.0 contains malicious code that collects the installer's hostname and sends it to an attacker-controlled Telegram bot channel. It acts as a remote access trojan (RAT) with spyware-like behavior, capable of executing remote commands and exfiltrating files. The package disguises itself as a generic utility but includes hardcoded Telegram Bot API endpoints for command and control communication.
The @grabcad/preferences-client npm package is a malicious package that acts as a dependency confusion attack vector. It exports a Proxy that returns no-op functions but executes a beacon script on import and post-install, sending sensitive environment information to an attacker-controlled server. This reconnaissance behavior discloses internal hostnames, install paths, and Node.js version to a hostile endpoint. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately from a different machine.
The npm package @grabcad/company-server-shared is a malicious placeholder package used in a dependency-confusion attack. It exports no real functionality but runs a post-install script and code on require that sends internal system information to an attacker-controlled IP address over plain HTTP. This includes hostname, installation path, current working directory, and Node/npm version. Installation of this package can lead to full system compromise, requiring immediate secret and key rotation and package removal.
The @cecm-web-sdk/core npm package contains malicious code that executes a postinstall script sending sensitive environment details to a remote IP address. The package exports a Proxy with no-op functions but triggers network beaconing on install and import, potentially exposing internal hostnames and project paths. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @blueskydataplatform/shared-ui contains malicious code that collects host identifiers and sends them in cleartext to a hardcoded external IP address. The beacon runs automatically during installation and when the package is imported, with no legitimate functionality. This behavior indicates the package is designed to report successful installation to an external operator, consistent with dependency confusion or namespace squatting attacks. Systems with this package installed should be considered fully compromised.
The npm package @tekmidian/pai versions 1.0.8, 1.0.9, and 1.0.10 contains malicious code. Although the codebase includes references to shell commands and base64 decoding, no direct evidence links these to active exfiltration or execution flows. However, the package is flagged as malware by a security source, indicating that any system with this package installed should be considered fully compromised. Immediate removal and secret/key rotation are recommended.
The npm package @factiii/runner contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but due to potential full control by an attacker, complete remediation may require additional measures such as rotating all secrets from a different, uncompromised system.
The npm package @seggy116/next-diff version 0.3.0 is identified as malicious. Although some analysis suggests the bundled UI code contains typical 'ping' tokens without direct evidence of exfiltration or credential theft, another source strongly indicates that any system with this package installed should be considered fully compromised. Immediate secret and key rotation is advised, and removal of the package is recommended, though complete remediation may require further system cleansing due to potential full control by an attacker.
The npm package @pkgship/frps-linux-amd64 version 0.71.1 is identified as malicious. It distributes a platform-specific binary for Linux AMD64 that is consistent with the frp reverse-proxy server, but the package is considered malware. Although no install-time execution or network behavior was observed in the initial inspection, the package is flagged as fully compromising any system where it is installed or running. Immediate secret and key rotation is recommended, and removal of the package is advised, but full remediation may require additional measures due to potential persistent compromise.
The npm package @pkgship/frpc-linux-amd64 version 0.71.1 contains malicious code. Although it ships a prebuilt binary without suspicious lifecycle scripts or network activity during installation, the package is identified as malware. Any system with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation and package removal. However, removal may not guarantee complete eradication of malicious software.
The npm package sdk-utils-testmetest version 1.0.0 is identified as malicious software. Although the package itself does not exhibit install-time execution or network activity, its installation compromises the host computer fully. Any secrets or keys stored on the compromised machine should be rotated immediately from a separate, secure device. Removal of the package alone may not eliminate all malicious components due to potential full system compromise.
The npm package @lumen-labs-dev/whisper-node version 0.5.1 is identified as malicious. Installation of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised device is strongly advised.
The darknode-cli npm package versions 2.46.0, 2.46.1, and 2.46.2 contain malicious code that functions as an offensive-security and penetration testing toolkit. While the package does not automatically execute upon installation or exfiltrate installer-side data, it exposes local HTTP control surfaces and includes modules that catalog offensive tools and sensitive file indicators. The package's capabilities are directed at operator-chosen external targets. According to one source, any system with this package installed or running should be considered fully compromised, and all stored secrets and keys should be rotated immediately.
The npm package x402-prompt-injection-scan version 0.1.4 is identified as malicious software. Although static and behavioral scans did not detect typical malicious behaviors such as network communication or credential harvesting, the package is considered fully compromising to any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised system is strongly advised.
The npm package 'imgdecode' versions 1.0.0 through 1.0.3 contains malicious code disguised as a native image buffer decoder. It includes a packed and obfuscated Windows PE binary that executes native code immediately upon module load on Windows x64 hosts. The package's JavaScript interface does not match its advertised API, indicating it is a facade for delivering malicious payloads. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated from a separate, clean device.
@liauto/darwin-x64 version 0.1.1-b3 is a malicious npm package containing harmful code. Installation of this package can lead to full system compromise. It is recommended to remove the package and rotate all secrets and keys from a separate, uncompromised device.
The npm package @pkgship/frpc-darwin-amd64 version 0.71.1 contains malicious code. This package ships a prebuilt binary for the darwin-amd64 platform. Although no install-time scripts, network callbacks, credential reads, or obfuscated code were identified in the shipped contents, the package is considered fully compromising to any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer is strongly advised.