The RubyGems package 'eth-keystore-utils' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes a hidden payload during gem installation. The payload establishes a persistent reverse shell to a hardcoded IP address, allowing remote command execution. The malicious code evades detection by checking for CI environments, sandbox indicators, and the presence of developer secrets before activating. The package was published on 2026-10-05 and targets Ethereum developers likely to have sensitive wallet and credential files.
The RubyGems package 'eth-address-utils' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes a hidden reverse shell payload during installation. The payload activates only on developer workstations, avoiding CI environments and sandboxes, and connects to a remote attacker-controlled server to provide full remote code execution under the installing user's privileges.
The npm package tostpro@100.2.0 contains a malicious preinstall script that executes automatically during installation. This script is obfuscated and designed to send the full environment variables, potentially including sensitive credentials, to a remote server after a specific date in 2026. The package's README falsely claims no network access or data collection, indicating deliberate evasion. This behavior poses a significant risk of credential leakage and unauthorized data exfiltration.
The npm package 'api-nebula' version 1.0.0 contains a malicious preinstall script that executes obfuscated JavaScript code during installation. This code uses a custom pseudo-random number generator and string-table decoder to conceal its true behavior, which includes executing arbitrary attacker-controlled code on the installer's machine. The obfuscation prevents static analysis from revealing network destinations or commands. Installing this package can lead to full system compromise, and any secrets or keys on the affected machine should be considered exposed and rotated immediately.
The npm package internallib_v275 version 1.0.3 contains malicious code that executes a reverse shell by fetching and running a payload from a hardcoded IP address. This allows remote attackers to gain interactive shell access on the host machine. The package uses an unauthenticated network retrieval without integrity verification, increasing the risk of compromise. Removal of the package alone may not fully remediate the infection due to potential persistence mechanisms.
The npm package @bellaxchuu/crystalred version 0.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @xatancchii/velycxbail version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The saturn-baileys npm package (version 1.0.0) is a malicious fork of the Baileys WhatsApp Web library that injects covert subscription actions into the WhatsApp socket layer. Upon connection, it silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package shadowmd version 8.6.87 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, and the malicious action abuses the installer's WhatsApp session to gain subscribers. The code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The anthropic-sdk package version 0.1.0 on PyPI contains malicious code that downloads and executes a remote script. It fingerprints the environment to detect sandboxing and delays execution before exfiltrating sensitive data such as credentials, environment variables, AI chat files, and SSH keys. If HTTPS exfiltration fails, it attempts DNS-based data exfiltration. The package also uses DNS to control execution centrally.
zencleaner versions 1.0.0, 1.0.3, and 1.0.3.1, advertised as local Windows cleaning tools with no telemetry or outbound calls, secretly send license keys, machine identity details, and public IP addresses to a hardcoded Discord webhook. Additionally, the software clears Windows event logs, including security logs, to evade forensic detection. These actions contradict the product's claims and pose privacy and security risks.
The virgil-cli npm package version 0.1.4 contains malicious behavior where it sends the entire conversation history, including potentially sensitive shell and file outputs, to a remote server without user consent. This occurs even in local mode, which is advertised as private. The package uses a hardcoded static token for authentication and allows remote command execution via a control server, which can be abused by attackers with network access. This behavior contradicts the privacy claims and poses a significant security risk.
The PyPI package 'caoxiltts' versions 0.1.0 and 0.1.1 contains malicious code that deploys a cryptocurrency miner instead of performing its advertised functions. This behavior is part of a campaign identified as 2026-10-voxeval, which involves malicious intent such as cryptomining. There is no CVSS score available for this threat.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (4abc7154004498e9054ca8ac239acd73ab86815f6029ad5d52e4c883488f4c70)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (12f18950a276ca27a304d3053835b0102656168083e7ddf414fffb112cbe01ba)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (28ef552864bd4b4558137163734077a2429281647a26868f40d8d735af95c967)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (18746c0b1bc840ee608e3aba81f9e18e4411373b8993d315177e95614fe67b08)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (92a0735c100233f803adcf4cec20645acbb5f01b1757e8889dfaa631e49dae71)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (c0f6ddfc6a324d42219bbea8405be17115f83eca0e2d2eecb4e3fe6b6ec3dbde)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (5050cd1cac91a217e828de6f54792051b810c43bf9ee5d53e913479fb059715c)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer