The npp-ml package on PyPI falsely claims to provide a Notepad++ distribution but instead delivers ADExplorer, an Active Directory analysis tool. This package is identified as malicious due to its deceptive nature and intent. The affected versions are 0.1.7, 0.1.8, and 0.1.9. There is no CVSS score available for this threat.
The @zanta/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that automatically subscribes the user's authenticated WhatsApp account to a specific WhatsApp Channel controlled by the publisher without user consent. This behavior occurs during the login-success event and is present in versions 1.0.0 and 1.0.1. The package does not exfiltrate credentials or maintain persistence, but it covertly inflates the publisher's channel subscribers using the victim's account.
The npm package @yudzxml/baileys contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, trusted machine. Simply removing the package does not guarantee removal of all malicious software introduced.
Ledger confirmed that some Ledger Nano X hardware wallets sold through the Southeast Asian reseller CryptoBilis were compromised with a hardware implant. This implant captured sensitive user inputs including seed phrases and transmitted them via an LTE connection using an embedded eSIM, enabling attackers to drain cryptocurrency wallets. The tampered devices were sold at significantly reduced prices and contained concealed malicious circuitry replacing original components. Ledger is investigating the incident, has halted sales through CryptoBilis, and advises affected users to avoid setting up compromised devices or to move assets to new wallets with new seeds. The affected volume is described as limited and no other resellers have been implicated so far.
The npm package @xrelly-stack/bails contains malicious code that fully compromises any computer on which it is installed or running. The presence of this package means that all secrets and keys stored on the affected computer should be considered compromised and must be rotated from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The node-telegram-sockets npm package contains malicious code that fully compromises any computer on which it is installed or running. This compromise allows an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to the extent of control gained, complete remediation may require rotating all secrets and keys from a separate, uncompromised device.
The npm package '@wanzxlonelyy/bailslonely' contains malicious code that fully compromises any computer on which it is installed or running. Removal of the package does not guarantee elimination of all malicious software, as the attacker may have gained full control. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised.
The npm package @wanzlonelyy/bailslonely contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker full control over the system, risking exposure of all stored secrets and keys. Immediate removal of the package is recommended, but due to potential persistent control, rotating all secrets from a different, trusted computer is essential.
The npm package @wanzlonely/bails4u versions 2.0.0, 3.0.0, 4.0.0, and 5.0.0 are malicious forks of the Baileys WhatsApp Web library. These versions contain injected code that silently subscribes the victim's WhatsApp account to attacker-controlled channels using the victim's authenticated session. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code, and the targeted channels are obfuscated or dynamically fetched to evade detection.
The npm package 'bailslonely' contains malicious code that fully compromises any computer on which it is installed or running. The compromise allows an attacker to potentially gain full control over the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, complete remediation may require additional measures such as rotating all secrets and keys from a separate, trusted machine.
The npm package @wanzlonely/bailsforme contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted device. Removal of the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package '@wanzlonely/bailsme' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have established persistent control over the system.
The npm package @wenzyx1/bails versions 1.0.0 and 1.0.1 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's session. The targeted channels are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @sanzoffc/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by its installation.
The npm package @sakataoffc/baileys is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels. This subscription leverages the victim's authenticated session and uses obfuscated or dynamically fetched target channels to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @sairidev/baileys-new version 0.3.21 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The malicious action leverages the authenticated WhatsApp session of the installer by injecting covert subscription commands into the WhatsApp socket connection. The targeted channels are obfuscated or dynamically fetched, allowing attackers to change targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @saazkira/eslint-config contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys. Immediate removal of the package is advised, but due to potential full control by an attacker, removing the package alone may not eliminate all malicious components.
The npm package @saazkira/libsignal-node contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of the malicious software or attacker control.
The @saazkira/baileys npm package versions 2.1.6 through 2.1.9 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert subscription action into the WhatsApp socket layer using the installer's authenticated session. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The npm package @revizahoshii/hoshino-fake-server contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected computer. Immediate removal of the package is advised, but due to potential full control by an attacker, removal alone may not eliminate all malicious components.