The trijigo-kalip package on PyPI version 1.0.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It appears to be a low-risk package resembling pentest or research tools but with a hidden data exfiltration purpose.
The PyPI package 'jiklpo-tsunari-kay' version 1.0.0 is identified as containing malicious code that uses fake HTTP-downloaded dependencies to track downloads. The package appears to have no legitimate purpose beyond this tracking behavior. It is categorized as a low-harm potential package, resembling typical pentest or research tools but with malicious intent related to dependency confusion.
The hijiko-pilaka package on PyPI is identified as malicious due to its use of fake HTTP-downloaded dependencies designed to track downloads. It serves no legitimate purpose beyond this tracking behavior.
The PyPI package 'facewareretargeter' is identified as malicious due to its use of fake HTTP-downloaded dependencies designed to track downloads without any legitimate purpose. It appears to be a dependency confusion attack vector, masquerading as a typical pentest or research package but with low direct harm potential.
The npm package '@securihackbot/depconf-stage-1792484738' contains malicious code in its postinstall hook that automatically executes upon installation. This code collects system information including hostname, local username, platform/architecture, Node.js version, package name, and a nonce, then encodes and sends this data via an unencrypted HTTP GET request to a hardcoded IP address. The package is designed to be used in dependency confusion attacks by being republished under victim-internal scopes, causing internal package resolution to fetch this malicious package from the public registry and leak sensitive environment information to the attacker.
The npm package rs-lookout-sandbox-poc version 1.0.1 contains malicious code that, upon being loaded, automatically collects the local system username and sends it to an external third-party URL. Additionally, it performs reconnaissance on the AWS Instance Metadata Service by attempting to retrieve an IMDSv2 token and enumerating IAM role credentials associated with the host. These actions occur without any explicit invocation by the user.
The npm package 'memories-core-web' version 99.0.0 contains a malicious preinstall script that automatically executes during installation. This script sends the installer's hostname and username to a third-party webhook.site URL, which is unrelated to the package publisher. This behavior results in unauthorized data exfiltration during the npm install process.
The semvver package on PyPI version 1.0.0 contains malicious code that downloads and executes a remote binary during installation. The setup.py script fetches an executable from a Cloudflare Workers domain without verification and runs it as a detached background process, enabling arbitrary code execution on the installer's system. The package itself has no legitimate functionality, indicating it is a typosquatting malware dropper.
The 'semveer' package on PyPI is a malicious typosquatting package that downloads and executes malware during installation. It uses a setup.py install hook to fetch a remote payload from an unrelated host without verification and runs it as a detached process. The package name closely mimics the legitimate 'semver' package, aiming to trick users into installing it.
The semmver package on PyPI is a typosquatting malicious package that executes attacker-controlled code during installation. Its setup.py downloads and runs an unverified binary from a suspicious external URL, leading to remote code execution on the installer's machine.
The semverr package on PyPI is a malicious typosquatting package that executes malware during installation. It downloads an unverified binary from an anonymous Cloudflare Workers URL and runs it silently on the victim's system. The package has no legitimate functionality and is designed to evade detection by swallowing errors during the download and execution process.
The npm package nwfp-build-config contains malicious code that exfiltrates user identity data via a covert DNS tunnel. Upon requiring the package, it encrypts the host's hostname and username using a hardcoded AES-256-CBC key, encodes the data, and sends it through DNS queries to an external domain unrelated to the package's stated purpose. This behavior indicates identity theft and unauthorized data leakage. Systems with this package installed should be considered fully compromised, and all secrets and keys should be rotated. Removal of the package alone may not fully remediate the compromise.
The npm package unicode-title-normalizer@1.0.0 contained a malicious install script designed to exfiltrate GitHub Actions CI tokens to a third-party webhook URL. The package's code itself was benign, but the install lifecycle script attempted to send the GITHUB_TOKEN environment variable to an attacker-controlled endpoint. The package was removed by npm shortly after discovery. This package appears to be a typosquatting or dependency confusion attempt targeting CI environments.
The npm package 'formatting-subtitles-for-claude' contains malicious code executed during installation via a postinstall hook that runs arbitrary shell commands from a separate dependency. The package masquerades as a clone of 'unicode-title-normalizer' but executes untrusted code at install time without integrity checks. Systems with this package installed should be considered fully compromised, and all secrets should be rotated. Removal of the package does not guarantee full remediation due to potential persistent compromise.
The PyPI package 'research-probe-6150c1c915' version 0.1.0 contains malicious code that automatically executes on every Python interpreter startup via a .pth file. This code collects environment variables, enumerates process command lines, and queries Google Cloud Platform (GCP) instance metadata endpoints to harvest service account OAuth tokens and other sensitive credential material. The collected data is stored in world-readable locations on the local filesystem, enabling any local user to access potentially sensitive cloud credentials. This behavior indicates reconnaissance and credential exfiltration activity targeting cloud environments.
The pafex package on PyPI version 2.3 is part of a malicious campaign involving embedded pickle files that execute arbitrary code during unpickling. This leads to persistence via a PTH file and downloads further payloads, although the final payload analyzed was a stub. The package is used as a dependency to deliver malicious code that can execute remote commands and exfiltrate files.
The PyPI package 'resion' version 22.0.1 contains malicious code embedded in a dependency named 'pafex'. This dependency loads a disguised pickle file that executes malicious code upon unpickling. The malicious payload establishes persistence on the victim's machine via a PTH file and downloads a secondary payload. The campaign associated with this package involves file exfiltration, obfuscation, remote command execution, and remote access trojan (RAT) behavior. The final remote payload observed was a stub, indicating potential further stages. No patch or fix information is provided.
The PyPI package 'workcalender' version 17.1.0.dev0 is identified as malicious due to its overridden install command in setup.py that executes malicious code during installation. Although no installer-side harm such as network I/O, credential scraping, or persistence mechanisms were observed, the package appears to be a developmental release uploaded with intent to exploit dependency confusion. This package is part of a campaign with clear malicious intent, including backdoor installation.
The PyPI package test-workalendar-internal versions 0.0.1, 0.0.2, and 0.0.3 contains malicious code that executes during installation. It installs a web terminal bound to localhost and exposes it via a Cloudflare tunnel, sending access credentials to an attacker-controlled server. This creates a remote shell backdoor on the installer's machine.
The npm package '@platform-services/hrm-mfe-core' version 99.9.1 is identified as malicious. It declares a dependency on itself using a URL pointing to an external S3 bucket (puffnetwork.com) rather than a standard registry version. This setup allows arbitrary code from the external source to be executed during installation without version pinning or integrity verification. The package also communicates with a domain linked to malicious activity.