The pyrechoasr package on PyPI is a malicious package falsely advertising as an audio-analysis profiles loader. Its actual purpose is to download and execute remote malicious scripts, continuing a known coin-mining campaign. The package version 0.1.0 is affected. No CVSS score is available for this threat.
The PyPI package 'driftwavets' version 0.1.0 is part of a malicious campaign that falsely advertises itself as an audio-analysis profiles loader. Instead, it downloads and executes remote malicious code, continuing a known coin-mining campaign. This package is designed to execute remote code without embedding the URL directly in the package.
The PyPI package 'novalithtts' version 0.1.0 is part of a malicious campaign falsely advertising itself as an 'audio-analysis profiles' loader. Instead of providing legitimate functionality, it downloads and executes remote malicious scripts, likely continuing a coin-mining campaign. There is no embedded URL in the package, indicating remote code execution is triggered externally. This package poses a direct threat by executing unauthorized code on affected systems.
The PyPI package 'voltswannts' version 0.1.0 is identified as malicious software that falsely advertises itself as an 'audio-analysis profiles' loader. Its actual purpose is to download and execute a remote malicious script, continuing a known coin-mining campaign. This package poses a direct threat by executing unauthorized remote code.
The PyPI package 'glassbeakasr' version 0.1.0 is part of a malicious campaign that falsely advertises itself as an audio-analysis profiles loader. Its true purpose is to download and execute remote malicious scripts, likely continuing a previous coin-mining campaign. There is no embedded URL in the package itself, indicating remote code execution is triggered dynamically. This package is identified as malicious software with intent similar to infostealers.
The emberlytts package on PyPI is part of a malicious campaign that falsely advertises itself as an 'audio-analysis profiles' loader. Its actual purpose is to download and execute remote malicious code. This package is linked to a known coin-mining campaign and is considered to have clear malicious intent.
The quasitonnts package on PyPI falsely advertises itself as an 'audio-analysis profiles' loader but is designed to download and execute remote malicious code. This behavior is linked to a broader malicious campaign involving coin-mining activities. The package version 0.1.0 is affected. There is no CVSS score available for this threat.
The ukraine69 package on PyPI contains malicious code that executes during import. This code attempts to escape sandbox environments, locate Telegram bot session files, and trigger malicious account deletions. The campaign associated with this package is identified as malicious with destructive actions and attempts to cover tracks.
The npm package @beloved-lenora/opencode-orchestrator contains malicious code that fully compromises any computer on which it is installed or running. Removal of the package does not guarantee elimination of all malicious software introduced. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised.
The npm package '@beloved-lenora/opencode-btw' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to secrets and keys stored on the affected system. Removal of the package does not guarantee complete eradication of the malicious software, as the attacker may have established persistent control.
The npm package @beloved-lenora/opencode-goal contains malicious code that fully compromises any computer on which it is installed or running. It can lead to complete system compromise, requiring immediate rotation of all secrets and keys from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package @beloved-lenora/opencode-stats contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may lead to unauthorized access to secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by it. Immediate rotation of all secrets and keys from a separate, uncompromised device is strongly recommended.
The npm package @beloved-lenora/opencode-todo contains malicious code that fully compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @beloved-lenora/opencode-shared-rpc contains malicious code that fully compromises any computer on which it is installed or running. Immediate removal of the package is advised, but full remediation requires rotating all secrets and keys from a different, uncompromised machine due to potential persistent control by an attacker.
The npm package @beloved-lenora/opencode-shell-guard contains malicious code that fully compromises any computer on which it is installed or running. Immediate rotation of all secrets and keys stored on the affected computer is required, and the package should be removed. However, removal does not guarantee elimination of all malicious software, as the attacker may have gained full control of the system.
The pyyi package on PyPI is a malicious package that impersonates the Python interpreter and executes remote code supplied by a command-and-control server. It registers console commands named after Python executables (e.g., python3.7) that shadow legitimate interpreters and send system information to an obfuscated server. The package fetches, decodes, decompresses, and executes arbitrary Python code in memory without any integrity checks. It also includes a fake Python REPL that captures single-token inputs as passwords and sends them to the attacker. This combination enables remote code execution and credential theft on affected systems.
The npm package @xatancchii/natabaileys contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a different, secure device. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The npm package 'parxleys' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the system. Immediate removal of the package is recommended, but due to the potential extent of the compromise, removing the package alone may not eliminate all malicious software. All secrets and keys stored on the affected computer should be rotated from a separate, secure machine.
The @flexmr/survey-conversation npm package contains malicious code due to its sole dependency being declared as a bare HTTPS URL, allowing arbitrary code execution from an external source. This design enables whoever controls the external host to execute any code on the installer's machine. The package is associated with a dependency-confusion attack and should be considered fully compromising any system where it is installed.
The npm package @flexmr/survey-client version 10.0.12 and several other versions declare a dependency as a bare HTTPS URL pointing to an external host unrelated to the official npm registry. This external host controls the code executed during installation, allowing arbitrary code execution on the installer's machine. The package exhibits dependency confusion markers and placeholder metadata inconsistent with a legitimate package, indicating malicious intent. Any system with this package installed should be considered fully compromised.