The npm package 'serpacksven2' contains malicious code that can fully compromise any computer on which it is installed or running. This compromise potentially grants an attacker full control over the affected system. Immediate removal of the package is recommended, but due to the severity of the compromise, simply removing the package may not eliminate all malicious components. All secrets and keys stored on the compromised system should be rotated from a separate, secure device.
The npm package 'documenclient' contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is advised, but full remediation may require rotating all secrets and keys from a different, uncompromised system due to potential persistent control by an attacker.
The npm package 'serpacksven' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious components, as the attacker may have gained full control of the system.
CVE-2026-104891 is an authentication bypass vulnerability in the douglasborthwick-crypto mppx-condition-gate packages. These packages improperly grant free access to payment routes by trusting a client-supplied wallet address without verifying control over that wallet. This allows attackers to name any qualifying wallet address and bypass payment. All published versions of both packages are affected. Fixed versions will require proof of wallet control before granting free access. Until patched, removing the condition gate or ensuring prior wallet binding is recommended.
The dzyhaxz-baileys npm package is a malicious fork of the Baileys WhatsApp library that automatically causes WhatsApp-authenticated users to follow a hardcoded channel without their consent. It also aliases critical cryptographic dependencies to author-controlled packages with mutable version tags, enabling supply-chain manipulation. This behavior violates the package's own documentation and poses a deceptive supply-chain risk. Although it does not steal credentials or enable remote code execution directly, any system with this package installed should be considered fully compromised.
The dzyclutch npm package, a fork of the Baileys WhatsApp library, contains malicious code that covertly subscribes the installer's WhatsApp account to author-controlled newsletter channels. This subscription occurs 30 seconds after connection and is hidden from the user by muting the channels. The list of subscribed channels is remotely controlled via a mutable GitHub raw URL, allowing dynamic changes without package updates. No credential theft, remote code execution, or data exfiltration outside WhatsApp is observed, but the installer's WhatsApp identity is misused to amplify the author's channel reach.
The npm package @diezyclutch/baileys contains malicious code or depends on a package with malicious code. Installing or running this package can lead to full compromise of the affected computer, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different machine is strongly advised. However, removal may not fully eliminate the threat due to potential persistent malicious software.
The npm package yonzoffic-baileys version 8.6.90 is a malicious fork of the Baileys WhatsApp Web library that injects code to silently subscribe the victim's WhatsApp account to attacker-controlled channels without user consent. The malicious code uses the installer's authenticated WhatsApp session to issue a covert FOLLOW query to subscribe to hidden WhatsApp Channel/Newsletter JIDs. The target JIDs are obfuscated or fetched dynamically, allowing attackers to change targets post-installation. This behavior does not steal credentials, establish persistence, or execute arbitrary code.
The npm package tostpro@100.2.0 contains a malicious preinstall script that executes automatically during installation. This script is obfuscated and designed to send the full environment variables, potentially including sensitive credentials, to a remote server after a specific date in 2026. The package's README falsely claims no network access or data collection, indicating deliberate evasion. This behavior poses a significant risk of credential leakage and unauthorized data exfiltration.
The npm package 'api-nebula' version 1.0.0 contains a malicious preinstall script that executes obfuscated JavaScript code during installation. This code uses a custom pseudo-random number generator and string-table decoder to conceal its true behavior, which includes executing arbitrary attacker-controlled code on the installer's machine. The obfuscation prevents static analysis from revealing network destinations or commands. Installing this package can lead to full system compromise, and any secrets or keys on the affected machine should be considered exposed and rotated immediately.
The npm package internallib_v275 version 1.0.3 contains malicious code that executes a reverse shell by fetching and running a payload from a hardcoded IP address. This allows remote attackers to gain interactive shell access on the host machine. The package uses an unauthenticated network retrieval without integrity verification, increasing the risk of compromise. Removal of the package alone may not fully remediate the infection due to potential persistence mechanisms.
The npm package @bellaxchuu/crystalred version 0.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @xatancchii/velycxbail version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The saturn-baileys npm package (version 1.0.0) is a malicious fork of the Baileys WhatsApp Web library that injects covert subscription actions into the WhatsApp socket layer. Upon connection, it silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package shadowmd version 8.6.87 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, and the malicious action abuses the installer's WhatsApp session to gain subscribers. The code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The virgil-cli npm package version 0.1.4 contains malicious behavior where it sends the entire conversation history, including potentially sensitive shell and file outputs, to a remote server without user consent. This occurs even in local mode, which is advertised as private. The package uses a hardcoded static token for authentication and allows remote command execution via a control server, which can be abused by attackers with network access. This behavior contradicts the privacy claims and poses a significant security risk.
@fastify/busboy versions from 1.0.0 up to but not including 3.2.1 are vulnerable to a denial of service (DoS) caused by multipart header names that collide with JavaScript prototype properties. This leads to a TypeError and can crash the Node.js process if unhandled. The vulnerability affects any unauthenticated client able to submit multipart/form-data requests. The issue is fixed in version 3.2.1.
@fastify/busboy versions from 3.1.0 up to but not including 3.2.1 are vulnerable to a denial of service (DoS) attack. The vulnerability arises from the handling of multipart boundaries in the streaming multipart search, where a crafted boundary of exactly 252 bytes causes a CPU-bound loop that stalls the Node.js event loop. This can be triggered by an unauthenticated client with a single small request. The issue is fixed in version 3.2.1.
Trigger.dev version 4.5.3 and earlier versions prior to 4.5.9 have a vulnerability where debug deployment logs expose resolved environment secret values in plaintext. When running a dry-run deployment with debug logging enabled, the complete environment variables including secrets such as database connection strings and service credentials are logged unredacted. This exposure occurs even though no actual deployment takes place. The issue allows anyone with access to debug logs or terminal transcripts to recover sensitive deployment secrets.
Trigger.dev has a vulnerability where the deployment cancel operation is scoped only by project ID and not by environment ID. This allows an API key for a lower-trust environment (e.g., dev) to cancel deployments in higher-trust environments (e.g., production) within the same project. The deployment GET route correctly enforces environment scoping, but the cancel route does not, creating an authorization bypass. This affects both self-hosted and cloud deployments of Trigger.dev prior to version 4.5.6.