The @cecm-web-sdk/core npm package contains malicious code that executes a postinstall script sending sensitive environment details to a remote IP address. The package exports a Proxy with no-op functions but triggers network beaconing on install and import, potentially exposing internal hostnames and project paths. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @blueskydataplatform/shared-ui contains malicious code that collects host identifiers and sends them in cleartext to a hardcoded external IP address. The beacon runs automatically during installation and when the package is imported, with no legitimate functionality. This behavior indicates the package is designed to report successful installation to an external operator, consistent with dependency confusion or namespace squatting attacks. Systems with this package installed should be considered fully compromised.
The npm package @tekmidian/pai versions 1.0.8, 1.0.9, and 1.0.10 contains malicious code. Although the codebase includes references to shell commands and base64 decoding, no direct evidence links these to active exfiltration or execution flows. However, the package is flagged as malware by a security source, indicating that any system with this package installed should be considered fully compromised. Immediate removal and secret/key rotation are recommended.
The npm package @factiii/runner contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but due to potential full control by an attacker, complete remediation may require additional measures such as rotating all secrets from a different, uncompromised system.
The npm package @seggy116/next-diff version 0.3.0 is identified as malicious. Although some analysis suggests the bundled UI code contains typical 'ping' tokens without direct evidence of exfiltration or credential theft, another source strongly indicates that any system with this package installed should be considered fully compromised. Immediate secret and key rotation is advised, and removal of the package is recommended, though complete remediation may require further system cleansing due to potential full control by an attacker.
The npm package @pkgship/frps-linux-amd64 version 0.71.1 is identified as malicious. It distributes a platform-specific binary for Linux AMD64 that is consistent with the frp reverse-proxy server, but the package is considered malware. Although no install-time execution or network behavior was observed in the initial inspection, the package is flagged as fully compromising any system where it is installed or running. Immediate secret and key rotation is recommended, and removal of the package is advised, but full remediation may require additional measures due to potential persistent compromise.
The npm package @pkgship/frpc-linux-amd64 version 0.71.1 contains malicious code. Although it ships a prebuilt binary without suspicious lifecycle scripts or network activity during installation, the package is identified as malware. Any system with this package installed or running should be considered fully compromised, requiring immediate secret and key rotation and package removal. However, removal may not guarantee complete eradication of malicious software.
The npm package sdk-utils-testmetest version 1.0.0 is identified as malicious software. Although the package itself does not exhibit install-time execution or network activity, its installation compromises the host computer fully. Any secrets or keys stored on the compromised machine should be rotated immediately from a separate, secure device. Removal of the package alone may not eliminate all malicious components due to potential full system compromise.
The npm package @lumen-labs-dev/whisper-node version 0.5.1 is identified as malicious. Installation of this package can lead to full compromise of the affected computer, potentially exposing all stored secrets and keys. Immediate removal of the package and rotation of all credentials from a separate, uncompromised device is strongly advised.
The darknode-cli npm package versions 2.46.0, 2.46.1, and 2.46.2 contain malicious code that functions as an offensive-security and penetration testing toolkit. While the package does not automatically execute upon installation or exfiltrate installer-side data, it exposes local HTTP control surfaces and includes modules that catalog offensive tools and sensitive file indicators. The package's capabilities are directed at operator-chosen external targets. According to one source, any system with this package installed or running should be considered fully compromised, and all stored secrets and keys should be rotated immediately.
The npm package x402-prompt-injection-scan version 0.1.4 is identified as malicious software. Although static and behavioral scans did not detect typical malicious behaviors such as network communication or credential harvesting, the package is considered fully compromising to any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised system is strongly advised.
The npm package 'imgdecode' versions 1.0.0 through 1.0.3 contains malicious code disguised as a native image buffer decoder. It includes a packed and obfuscated Windows PE binary that executes native code immediately upon module load on Windows x64 hosts. The package's JavaScript interface does not match its advertised API, indicating it is a facade for delivering malicious payloads. Any system with this package installed should be considered fully compromised, and all secrets and keys on that system should be rotated from a separate, clean device.
In September 2026, an SEO poisoning campaign distributed Armorsteal malware via fake websites impersonating Chocolatey and Microsoft Activation Scripts tools. The malware is Python-based, protected by Pyarmor, and includes modules for remote access, surveillance, and information stealing. It captures keystrokes, clipboard data, cryptocurrency wallets, browser data, Discord tokens, passwords, and SSH keys. The campaign uses anti-analysis techniques such as cloud provider detection and code obfuscation, with frequent infrastructure changes observed. No patch or remediation is indicated, and no known exploits in the wild are reported.
The LiteLLM project's release pipeline was compromised on October 21, 2026, resulting in the distribution of malicious versions of the LiteLLM PyPI package and Docker images. The compromised version 1.107.0 contained malware that steals credentials, secrets, environment variables, and other sensitive data from affected systems. The malware executes automatically on Python startup by placing malicious files in the Python library directory. The attack impacted all PyPI wheels for LiteLLM 1.107.0 and Docker images tagged with v1.107.0 and related tags. The malicious packages have been removed, and users are advised to stop affected deployments, isolate infected systems, and rotate exposed secrets. The recommended clean version is LiteLLM 1.106.2.
TRUST#GRAFT is a sophisticated malware attack targeting authenticated WordPress administrator browser sessions. It uses JavaScript loaders that mimic Cloudflare verification screens to fingerprint browsers, harvest credentials, and profile environments. Upon detecting an active WordPress admin session, it extracts CSRF tokens and uploads a malicious plugin disguised as 'Web Media Optimizer.' The PHP backdoor persists by copying itself to the must-use plugins directory, injects remote JavaScript into public pages, provides token-gated admin access, and hides from standard plugin management interfaces. This attack leverages existing trusted sessions without authentication bypass and involves coordinated infrastructure across multiple domains.
In October 2026, the autonomous AI penetration-testing agent ARTEX was used by the Storm-0940 actor, linked to Chinese state interests, to target IT and software vendors. The attacks focused on identity providers such as Okta, Entra, and Cognito. Techniques included mapping applications via JavaScript bundles and source maps, probing authentication mechanisms, manipulating OAuth callbacks, password spraying, abusing account recovery endpoints, and testing tenant isolation. Sessions lasted 24-30 hours with automatic IP rotation upon blocking. The agent exhibited automated step chaining, output-based adaptation, and relentless iteration. Attacks involved coordinated bursts with unique user agents and rapid attempts targeting software engineers across many users.
MythicRatatoskr is a Go-based backdoor leveraging the Yggdrasil mesh network for encrypted, decentralized command and control communications. It was deployed in a coordinated attack involving UAC-0099 and Sandworm targeting a Ukrainian grain logistics company in mid-2025. The backdoor provides typical malicious capabilities such as command execution, file transfer, screenshot capture, and SOCKS5 proxying. The attack sequence included initial access via spearphishing, backdoor deployment, and a subsequent destructive data-wiping phase using SDelete via Active Directory Group Policy. This incident marks the first known use of Yggdrasil by state-aligned threat actors for C2 communications.
StealC malware has resurfaced as Stadia, a remote access trojan (RAT) that incorporates StealC's original code. Stadia extends capabilities beyond simple data theft to include hidden desktop control, live command shell, file management, process management, and in-memory loading. It communicates via plain HTTP to hardcoded IPs using RC4 encryption with Base64 encoding and persists through hidden scheduled tasks in randomized directories mimicking legitimate updaters. The operator targets former StealC customers with subscription offers. No official patches or fixes are available, and no known exploits in the wild have been reported.
@liauto/darwin-x64 version 0.1.1-b3 is a malicious npm package containing harmful code. Installation of this package can lead to full system compromise. It is recommended to remove the package and rotate all secrets and keys from a separate, uncompromised device.
The npm package @pkgship/frpc-darwin-amd64 version 0.71.1 contains malicious code. This package ships a prebuilt binary for the darwin-amd64 platform. Although no install-time scripts, network callbacks, credential reads, or obfuscated code were identified in the shipped contents, the package is considered fully compromising to any system where it is installed or running. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
