The dsh-notify-focus npm package contains malicious code that fully compromises any computer on which it is installed or running. Removal of the package does not guarantee elimination of all malicious software installed as a result. Immediate rotation of all secrets and keys stored on the affected computer is strongly advised.
The pulumi-doppler package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The npm package @cherrydotfun/miniapp-sdk versions 0.1.22 and 0.1.23 contain malicious code. Any computer with this package installed or running is considered fully compromised, potentially allowing an attacker full control. Immediate removal of the package and rotation of all secrets and keys from a different computer are strongly advised.
The PyPI package 'fhqiouhq' version 0.1.0 contains malicious code that exfiltrates sensitive Telegram files to a remote location upon import. This package is identified as part of a typosquatting campaign targeting Telegram users, aiming to steal information.
The PyPI package 'ajfhiuqhfqgwerhuqnfqh' version 0.1.0 contains malicious code that exfiltrates sensitive Telegram files to a remote location during import. This package is identified as part of a typosquatting campaign targeting Telegram users with clear malicious intent to steal information.
The PyPI package 'reqnests' versions 0.1.0 and 0.1.1 contains malicious code that exfiltrates sensitive Telegram files to a remote location upon import. This is a typosquatting campaign with clear malicious intent targeting Telegram data.
The PyPI package 'reqnest' version 0.1.0 contains malicious code that exfiltrates sensitive Telegram files to a remote location upon import. This package is identified as a typosquatting attempt with clear malicious intent targeting Telegram data.
The tailwind-animationfound package on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package 'modelsdesk' version 0.4.2 contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential exposure of all secrets and keys stored on the affected system. Immediate removal of the package is recommended, but due to the extent of control given to the attacker, complete remediation cannot be guaranteed by removal alone.
The npm package 'kampodine' version 0.8.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'automic-style-engine' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The hello-bat-fwi9 package on PyPI contains an obfuscated batch (.bat) file that delivers a Remote Access Trojan (RAT) using its own Python runtime and PTH files. The malicious code requires manual activation to execute. This package is part of a known malicious campaign identified as 2026-11-hello-bat-fwi9, continuing a previous campaign named 2026-11-filipt.
The monobomber npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all resulting malicious software, as the attacker may have gained full control of the system.
The npm package 'monopw' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets from a different, secure computer is strongly advised.
The npm package 'tw-motion-css' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removal of the package alone does not guarantee elimination of the malicious software or attacker control.
The npm package 'wisdomtreetest' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets and keys from a different, uncompromised computer is strongly advised. However, removal of the package alone may not eliminate all malicious software introduced by it.
The npm package '@ts-expect-error/n' contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, uncompromised device. Removing the package alone does not guarantee removal of all malicious software or backdoors introduced by the package.
The npm package '@site-cms/ssr' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Simply removing the package may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The @sideeffects/n npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software or control established by the attacker.
The npm package @noinheritdoc/n contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package does not guarantee elimination of all malicious software introduced by the package.