The npm package '@fazzcodestudio/mediaformater' contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Simply removing the package does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @badzz88/eslint-config contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected computer should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @astracode/byles-new contains malicious code that silently subscribes a victim's authenticated WhatsApp account to attacker-controlled channels without consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query upon connection. The targeted WhatsApp channel IDs are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @modss/libsignal contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package @mivesensei/baileys version 0.4.2 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's session. The targeted channel IDs are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
VulcanRAT207.A is a sophisticated multi-stage malware intrusion chain initiated via a WhatsApp-delivered financial document lure. The malware uses compression and extensive host screening before escalating privileges to SYSTEM level through COM-based techniques and PoolParty Variant 7 injection. It deploys a signed driver to disable security processes, establishes persistence via DLL side-loading with a legitimate Intel-signed executable, and launches a WebSocket-based remote access trojan. The final payload provides extensive surveillance capabilities including shell access, keystroke logging, desktop control, network filtering, and process injection.
The npm package @mikudeveloper/libsignal-node contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is recommended, but due to potential persistent malicious software, complete remediation may require additional measures such as rotating all secrets and keys from a separate, trusted device.
The npm package @mikudeveloper/grace versions 2.0.1, 1.0.21, and 1.0.20 contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This malicious behavior leverages the victim's authenticated WhatsApp session. The injected code does not steal credentials, maintain persistence, or execute arbitrary remote code, but it enables stealthy and flexible subscription to hidden or dynamically fetched channels.
The npm package @lekzo_dev/amprem contains malicious code that fully compromises any computer on which it is installed or running. The compromise may allow an attacker full control over the system, risking exposure of all stored secrets and keys. Immediate removal of the package is advised, but removal alone may not eliminate all malicious components. Secrets and keys should be rotated from a different, uncompromised machine.
The npm package 'amprem' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully remediate the infection, as the attacker may have established persistent control over the system.
The @kanaraa/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert channel-subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query using the installer's WhatsApp session. The targeted channels are obfuscated or dynamically fetched, allowing attackers to modify targets after installation. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The npm package @jojoxyz/condemnedforce-baileys version 2.3.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. The targeted channels are obfuscated or dynamically fetched to avoid detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @ikanngeming/ikannbail versions 1.0.2 through 1.0.7 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This malicious behavior leverages the installer's authenticated WhatsApp session to issue covert subscription requests. The targeted channels are obfuscated or dynamically fetched. The code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
AvisLoader is a newly identified Windows malware loader that employs encrypted peer-to-peer communications to protect its command-and-control infrastructure from disruption. It uses ClickFix delivery methods, shortcut-based persistence mechanisms, and supports remote command execution. This design aims to enhance the malware's resilience and operational stealth.
Funhouse ransomware, distributed by a North Korean threat actor linked to Kimsuky, uses malicious Korean-language resume documents to infect targets. It is a variant of the Endpoint ransomware family, employing multi-stage scripts (Batch, VBS, PowerShell) to install Quasar RAT before deploying ransomware. The campaign shows strong similarities to earlier Kimsuky Endpoint operations, with updates in encryption extensions, contact info, and command-and-control infrastructure. The initial infection vector shifted from LNK files to HWP documents. No known exploits in the wild or patches are applicable as this is malware distribution.
A sophisticated malware campaign named Midnight Mimosa targets low-cost Android devices using MediaTek platforms by preinstalling malicious code in device firmware before user acquisition. The malware operates as a platform-signed system application with elevated privileges, allowing silent installation of apps, permission grants, and remote code execution. It primarily facilitates ad fraud, click fraud, device data collection, and converts infected devices into residential-proxy botnet nodes. The malicious app disguises itself under system-like names and disables Google Play Store during payload deployment to evade detection. Several related malicious apps were also found on Google Play, linked to the same command-and-control infrastructure.
The minecraftaccfinder package published on PyPI in multiple versions was a malicious package designed to steal credentials and session data from the victim's machine. It exfiltrated browser-stored logins and session cookies, collected the machine's public IP address and account identifiers, and sent this data to a hard-coded webhook. The package also installed persistent malware including a remote access trojan (RAT), keylogger, screenshot capture, and credential theft targeting multiple services such as Gmail, Roblox, Discord, and Minecraft. The package has been removed from PyPI.
The luoxy-baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that automatically subscribes the user's authenticated WhatsApp account to certain WhatsApp Channels (newsletters) chosen by the publisher. This auto-subscription occurs without explicit user consent, triggered 90 seconds after a WhatsApp connection is established. The list of channels to follow is partially hardcoded and partially fetched at runtime from a publisher-controlled GitHub URL, allowing dynamic modification of subscribed channels. The package does not exfiltrate credentials or install persistent backdoors, but it covertly inflates the publisher's channel subscriber counts. This behavior is enabled by default and undocumented except for a comparison table in the README. A user can opt out by setting a configuration flag to false.
The hridoy-ultimate npm package version 8.0.0 is an unofficial Facebook chat client containing malicious behaviors. It forwards user Facebook credentials and 2FA secrets to a hardcoded third-party server, exposing user accounts to full compromise. Additionally, it dynamically pulls and executes code from an unpinned GitHub repository during installation, allowing arbitrary code execution without integrity checks. A remote-control WebSocket client is present but opt-in and gated by configuration.
A malware infection at Nippon Columbia, a contractor of Daiichi Kosho, led to the exposure of over 8.7 million customer and employee records related to karaoke fans. The incident involves unauthorized access to sensitive personal data due to malware compromise.
