The PyPI package melcuratts version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the package itself does not execute attacker-controlled code during installation or import, nor does it harvest credentials or communicate with attacker servers directly, it is designed to download and run remote malicious scripts. This behavior indicates a coordinated effort to distribute malicious payloads through deceptive loader packages.
The PyPI package quillonatts version 0.1.0 is part of a malicious campaign involving loader packages designed to execute code from remote URLs. While the package itself does not contain direct malicious payloads or exhibit typical supply-chain attack behaviors such as credential harvesting or persistence mechanisms, it facilitates downloading and executing remote malicious scripts. This coordinated campaign aims to provide multiple deceptive methods to load malicious code.
The shellgrip 0.1.0 package on PyPI is part of a malicious campaign that involves loader packages designed to execute code from remote URLs. Although the package itself does not show installer-side harm or direct malicious payloads, it facilitates the downloading and execution of remote malicious scripts. This behavior is indicative of a coordinated effort to distribute malicious code through deceptive means.
The batchspar 0.1.0 package on PyPI is part of a malicious campaign that involves loader packages designed to execute code from remote URLs. While the package itself does not contain a direct malicious payload or exhibit harmful behaviors during installation or import, it is intended to facilitate the execution of remote malicious scripts. This activity is associated with a coordinated campaign named '2026-10-voice-synthesis-profiles' that aims to deploy deceptive loaders for malicious code execution.
The PyPI package 'crenelatts' version 0.1.0 is part of a malicious campaign involving loader packages that execute code from remote URLs. Although the package itself does not contain a direct malicious payload or exhibit harmful behaviors such as credential theft or backdoors, it is designed to download and execute remote malicious scripts. This indicates a coordinated effort to distribute malicious code through deceptive means.
The libseal package on PyPI, versions 1.1.0 through 1.1.3, is involved in a malicious campaign where it provides decryption algorithms for an encrypted payload delivered by another package, iterquarry. Earlier versions contained an embedded key and communicated with a Discord bot, but recent versions removed the embedded key, leaving the payload unknown. Static analysis found no installer-side harmful behaviors in libseal itself, but the campaign is classified as malicious due to obfuscation and hidden malicious code within dependencies.
The iterquarry Python package (versions 2.1.1 through 2.2.1) is part of a malicious campaign involving obfuscated code execution. It acts as a thin wrapper over a sibling package, libseal, which contains encrypted payloads decrypted and executed at runtime using hardcoded or embedded keys. Earlier versions included a payload that contacted a Discord bot, indicating malicious intent. The package itself does not provide legitimate iterator functionality but instead executes arbitrary encrypted code from its dependency.
The npm package @worrisome/aaaa contains malicious code that impersonates a Cloudflare Turnstile security check page. When loaded in a browser via an npm CDN, it fetches and decrypts a destination URL and redirects the browser to a runtime-chosen URL. The package does not execute code during installation or require/import in Node.js, so the threat targets end-user browsers loading the HTML through CDNs, not developers or build systems. Computers with this package installed or running should be considered fully compromised, and all stored secrets and keys should be rotated immediately.
The npm packages pixel-map-testmetest versions 0.0.1 and 0.0.2 contain malicious code that executes at install time via a node-gyp binding.gyp script. This script runs an obfuscated loader that decrypts and decompresses an encrypted payload, then executes it using the Bun runtime. The package masquerades as a benign placeholder but actually delivers a credential stealer payload. The malicious behavior is hidden through multi-layer obfuscation and use of an alternate runtime, making static analysis difficult.
The npm package test-brotli-testmetest version 1.0.0 contains malicious code that executes during installation. Its install script triggers a node-gyp rebuild that runs an obfuscated JavaScript loader (index.js). This loader decrypts and executes a Brotli-compressed payload, effectively running attacker-controlled code at install time without user visibility. The package was published by the npm account testnewtestme2 on 2026-10-21.
The npm package test-brotli2-testmetest version 1.0.0 contains malicious code that executes during installation. Its install script triggers node-gyp to run an obfuscated JavaScript loader (index.js) that decrypts and executes a Brotli-compressed payload. This payload acts as a credential stealer. The package was published by the npm account testnewtestme2 on 2026-10-21.
log-sink-testmetest version 1.0.1 is a malicious npm package that executes a concealed credential stealer during installation. It abuses the node-gyp build process by embedding a binding.gyp file that triggers execution of an encrypted payload without any native source code. The payload is heavily obfuscated and decrypts an AES-128-GCM encrypted blob, which is then executed either directly in Node.js or via the Bun runtime to evade detection. The package was published on 2026-10-21 by the npm account 'testnewtestme2'. Version 1.0.0 is clean and unaffected.
The npm package data-pipeline-testmetest version 2.0.1 contains malicious code that executes during installation without a declared install script. It uses a binding.gyp file to run an obfuscated loader that decrypts and executes a large payload. This payload steals credentials from GitHub, npm, PyPI, RubyGems, and cloud services, then commits them to a public GitHub repository created in the victim's account. It also republishes the victim's packages with the same malicious hook. If a GitHub token is found, it installs a destructive service that deletes the user's home directory once the token is revoked. Removal of this service before token revocation and credential rotation is necessary to prevent data loss.
The npm package event-emitter-testmetest contains malicious code in specific versions that use multi-layer obfuscation to execute attacker-controlled payloads. Versions 1.0.6 and 1.0.7 run an obfuscated loader that decrypts and executes code on load or during npm install via a binding.gyp hook. Versions 4.1.0 and 5.0.0 include a stealer payload executed similarly through binding.gyp. Other versions do not contain executable payloads.
The npm package 'peptide-modify' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The moveworks-capi-starter package on PyPI contains malicious code that executes during installation. It overrides the install command in setup.py to collect the installer's hostname and local IP address, then sends this information as JSON to a hardcoded external URL without user consent or disclosure. The package has no legitimate documented functionality and acts as a proof-of-concept beacon. The exfiltrated data is limited to host identifiers and does not include credentials.
The npm package my-auto-follow-eltio@1.0.0 is a fork of the Baileys WhatsApp library that includes obfuscated code. Although the visible code does not show direct malicious actions such as remote code execution or credential theft, the package is flagged by a malware source as fully compromising any computer on which it is installed. It is recommended to consider any system with this package compromised, rotate all secrets from a clean system, and remove the package.
The @alannxd/baileys npm package is a malicious third-party fork of the legitimate @whiskeysockets/baileys WhatsApp library. Upon import, it performs an HTTPS GET request to a mutable URL controlled by the author, revealing the consumer's IP address. Although it does not execute remote code or exfiltrate credentials directly, the package poses a risk due to its namespace confusion potential and the import-time beacon to an author-controlled source. Security sources warn that any system with this package installed should be considered fully compromised, recommending immediate secret and key rotation and package removal.
The npm package tellyo-colours version 21.3.1 includes a runtime dependency on abbishal-poc-as-dependency with a wildcard version, allowing arbitrary code execution during installation. This dependency can fetch and run any version published by the dependency's controller, potentially executing malicious lifecycle scripts. The package is considered fully compromising any system where it is installed, requiring immediate secret and key rotation and removal of the package.
The hijok-lampam package on PyPI is identified as malicious due to its use of fake HTTP-downloaded dependencies intended to track downloads. It serves no legitimate purpose beyond this tracking behavior and is associated with dependency confusion tactics. The package version 1.0.0 is affected. There is no evidence of active exploitation in the wild.