The opencode-skills-collection npm package contains multiple utility scripts that perform network operations such as curl, ping, GET, and POST requests. These scripts do not automatically execute during installation and do not contain hardcoded attacker command and control servers or environment scraping. However, the package is flagged as malicious by GHSA malware sources, indicating that any system with this package installed should be considered fully compromised, and all secrets and keys should be rotated. Removal of the package alone may not eliminate all malicious software.
The npm package 'agentic-awesome-skills' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
SiriusQT is a Windows Remote Access Trojan (RAT) distributed as Malware-as-a-Service since April 2026. It offers advanced capabilities including hidden VNC, credential theft, cryptocurrency wallet collection, clipboard monitoring, keylogging, process injection, and persistence. The malware uses custom encrypted command-and-control communication and has both native C++ and .NET loader variants. It is distributed primarily by a reseller named GhostKernel and targets victims in several European countries including the UK, Germany, France, Spain, Italy, and the Netherlands.
DarkCore is a newly discovered Remote Access Trojan (RAT) that facilitates credential theft, hidden desktop access, and session hijacking through a dedicated browser. It reuses stolen session cookies to access services like Gmail, WhatsApp, and MediaFire, routing traffic through victims' IP addresses to appear legitimate. The malware is distributed with a deceptive PDF-themed shortcut that downloads both a decoy document and a malicious executable. Operators can control infected machines via hidden virtual network computing (HVNC) and extend functionality through additional modules. The RAT communicates with a hardcoded command and control server and disguises itself using legitimate Windows process names. No official patch or remediation guidance is currently available.
The PyPI package '1h1' version 1.0.0 is identified as malicious. During installation, it downloads and executes malware, indicating clear malicious intent including potential infostealing. This package is associated with typosquatting tactics to deceive users into installing it.
The aanthropic package on PyPI version 1.0.0 is identified as malicious. During installation, it downloads and executes malware, indicating clear malicious intent. This package is associated with a typosquatting campaign designed to trick users into installing harmful software.
The net-codec-testmetest npm package version 1.0.1 contains malicious code that abuses the node-gyp build process to execute an obfuscated payload during installation. This payload decrypts and decompresses an embedded binary, which is then executed under the Bun runtime. The package serves as a dropper with no legitimate functionality, designed to stealthily execute arbitrary code on the host system.
The npm package 'log-rotate-testmetest' version 1.0.1 contains malicious code embedded in its binding.gyp file that triggers execution of an obfuscated payload during installation. This payload uses multiple layers of obfuscation including ROT cipher, AES-128-GCM decryption, and brotli decompression, ultimately executing attacker-controlled code via the Bun runtime. The package declares Bun as a runtime dependency to route execution through an alternate runtime rather than Node.js. There is no legitimate native build rationale for this behavior, indicating deliberate malicious intent.
The npm package 'formatting-subtitles' version 1.0.2 contains malicious code in its preinstall script. The script masquerades as JavaScript but is executed by the shell, which runs attacker-controlled commands. During installation, it fetches and executes arbitrary code from a mutable GitHub Gist and sends installation metadata to an attacker-controlled webhook. This behavior allows remote code execution and data leakage during npm install.
The npm package @conduitops/logview-archive version 1.0.1 contains malicious code that executes during installation. Its postinstall script runs install.js, which installs another package from a concealed, non-public HTTP registry controlled by an attacker. This allows arbitrary code execution on the installer's system at install time. The package deliberately obfuscates the malicious registry URL using base64 and XOR encoding to hide the attacker's endpoint.
The npm package simplewave version 0.0.2 contains malicious code that executes a postinstall script during installation. This script performs an HTTP GET request to a subdomain of oast.fun, embedding the installer's hostname in the request, thereby exfiltrating the host identifier to a third-party server without user consent. The package's main file is a trivial stub with no legitimate functionality, indicating the primary purpose is data exfiltration.
In October 2026, a Chinese-speaking threat actor conducted a global AI-assisted hacking campaign using the ARTEX penetration testing framework combined with multiple AI coding assistants. The attacks targeted organizations across finance, retail, education, cryptocurrency, and telecommunications sectors in over 20 countries worldwide. The campaign utilized custom scripts to maintain context across AI sessions and divided tasks among specialized AI agents. The attackers sought bulk personal data, transaction records, and mobile phone numbers, with indications of intent to sell stolen information on underground markets. The workflow included peer review among AI models to improve effectiveness. The campaign is financially motivated and opportunistic in nature.
The acoustichub 0.1.0 package on PyPI is part of a malicious campaign that involves loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the malicious payload or exhibit install-time execution hooks or suspicious behaviors, it serves as a mechanism to load malicious code from external sources. This campaign is identified as having clearly malicious intent, such as infostealing.
The phonemeprobe package on PyPI version 0.1.0 is part of a malicious campaign that involves loader packages designed to download and execute remote malicious scripts. Although the package itself does not contain the payload, it acts as a delivery mechanism for malicious code. No credential access, outbound network activity, or installer-affecting behavior was detected in the shipped files, but the overall intent is clearly malicious.
The ttsflow package version 0.1.0 on PyPI is associated with a malicious campaign involving loader packages that execute code from remote URLs. While the package itself does not contain direct malicious payloads or exhibit typical supply-chain attack behaviors such as credential harvesting or backdoors, it is part of a coordinated effort to provide deceptive methods for loading malicious code remotely.
The evalstream package version 0.1.0 on PyPI is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the package itself does not contain a direct malicious payload or exhibit typical supply-chain attack behaviors such as credential scraping or persistent backdoors, it is designed to download and execute remote malicious scripts. This behavior indicates a coordinated effort to provide multiple deceptive methods to load malicious code remotely.
The speakbench package version 0.1.0 on PyPI is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. Although the package itself does not show installer-side harm or suspicious behavior during installation or import, it is designed to fetch and run malicious code from external sources. This activity indicates a coordinated effort to distribute malware through deceptive loader packages.
The audiokit package version 0.1.0 on PyPI is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. While the package itself does not contain the payload or exhibit harmful behavior at install or import time, it serves as a deceptive loader to fetch malicious code. This campaign is identified as having clear malicious intent.
The phonemeforge package on PyPI version 0.1.0 is part of a malicious campaign involving loader packages that download and execute remote malicious scripts. While the package itself does not exhibit installer-facing harm such as network activity or credential theft during installation or import, it is designed to load and run potentially harmful code from external sources.
The vocabbench package version 0.1.0 on PyPI is part of a malicious campaign that involves loader packages designed to download and execute remote malicious scripts. Although this specific package version does not exhibit direct credential theft, remote code execution, or backdoor behavior on its own, it serves as a mechanism to load malicious code from external sources. This activity is part of a coordinated campaign with clearly malicious intent.
