The npm package 'test-account-portal-fe' version 100.100.102 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain known for malicious activity. There is no CVSS score available for this threat. No official patch or remediation guidance is provided in the source data. No known exploits in the wild have been reported. The affected version is exactly 100.100.102.
The npm package 'kmf-bootstrap' versions 100.100.102 and 100.100.103 have been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain linked to malicious activity. No CVSS score is available for this threat.
The npm package 'bungoma' versions 1.0.0, 1.0.1, and 1.1.0 are malicious forks of the Baileys WhatsApp Web library. These versions contain code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, enabling attackers to change subscription targets after installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @bellaxchuu/teambails contains malicious code that silently subscribes a victim's authenticated WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert subscription action into the WhatsApp socket layer, issuing an authenticated FOLLOW query to obfuscated or dynamically fetched WhatsApp Channel/Newsletter JIDs. The malicious code does not steal credentials, establish persistence, or execute arbitrary remote code.
The npm package @tunstock/remact-dom is a typosquatting malicious package impersonating the legitimate react-dom package. It includes a postinstall script that automatically runs during installation, collecting system and project information and exfiltrating it to a suspicious third-party domain. The package falsifies its identity in the data sent to the attacker’s server, indicating a reconnaissance attempt for further supply-chain compromise.
Ransomware threat actors are shifting tactics away from encrypting data to extorting victims through data theft and demonstrating access by hijacking Active Directory environments. The PAYLOAD campaign exemplifies this trend by using malicious Group Policy Objects to display ransom notes and lock screens without encrypting files. This shift is driven by the increasing difficulty attackers face in collecting ransom payments due to widespread backup practices and the complexity of decrypting large-scale infections. Instead, attackers steal confidential data and threaten publication, which can cause reputational damage and regulatory penalties. Data exfiltration is also harder to detect than encryption-based attacks, making it a more attractive method for extortion. Businesses are advised to maintain strong cyber hygiene, including regular backups, patch management, endpoint protection, and access control to mitigate these evolving extortion threats.
The npm package 'kmf-vendor-pack' version 99.0.0 contains malicious code that executes automatically upon installation. It runs a postinstall script that sends an HTTPS request to an attacker-controlled domain, leaking the installer's OS hostname and username. This behavior confirms unauthorized code execution and data exfiltration without user interaction.
The pxnpm package versions 7.0.0-beta.6, 7.0.0-beta.8, 7.0.0, 7.0.1, and 7.0.2 contain malicious code that silently downloads and executes a native binary from a private host controlled by the author. During installation and every run, pxnpm forcibly replaces all user npm and proxy settings with hardcoded author-controlled registry and proxy URLs, routing all package traffic through an author-operated man-in-the-middle proxy. This allows the author to observe, log, or modify all dependency traffic without user consent or disclosure.
Midnight Mimosa is a malware campaign involving preinstalled firmware malware on low-cost Android devices, primarily built on MediaTek platforms. The malware runs with system-level privileges, allowing remote operators to install and remove apps, grant permissions, and load arbitrary code. It is focused on ad fraud, automated click fraud, and building large botnets. The campaign affects devices in over 150 countries, with no single region dominating. Additionally, related apps carrying the same malware code have been found on Google Play, though with less privilege. The malware disables Google Play Protect during malicious app installations to evade detection. This campaign represents a supply-chain threat with persistent, preinstalled malware that cannot be removed by normal uninstall methods.
In late September 2026, seven malicious npm packages impersonating a NebulaAI SDK were deployed to deliver a Windows remote-access trojan (RAT). The RAT uses direct NT and win32k syscalls, avoiding DLL imports, and includes features such as hidden-desktop remote control, camera and microphone monitoring via Kernel Streaming, and persistence through Winlogon Shell. The malware communicates with a command-and-control server at 65.87.7.132 and disguises itself as conhost.exe while employing anti-analysis techniques.
Warden Stealer is a Rust-based infostealer malware-as-a-service that has rapidly gained prevalence since August 2026. It targets a wide range of cryptocurrency wallet extensions and applications, and uniquely collects data from AI assistants and agentic coding tools. Distributed via cracked software, game cheats, malvertising, and ClickFix campaigns, it uses advanced obfuscation and bypass techniques to steal sensitive browser data. The malware avoids CIS and Baltic countries and operates on a tiered subscription model.
The PyPI package ig-gox version 1.0.0 contains malicious code that executes a concealed payload upon import. This payload is base64-decoded, XOR-decrypted, decompressed, HMAC-verified, and then executed dynamically. The package employs anti-analysis techniques to detect debugging, decompilation, and sandbox environments, exiting if such conditions are detected. It downloads and executes remote malicious scripts designed to abuse Instagram services for mass fake account registration.
MATCHBOIL is a custom C# downloader malware used by the Russia-aligned APT group UAC-0099. It downloads and installs payloads from command-and-control servers and establishes persistence on victim machines. The malware has evolved since April 2024, adding obfuscation, sandbox detection, and changing persistence mechanisms. It is distributed via spearphishing emails with malicious links that download VBScript files. MATCHBOIL typically delivers the MATCHWOK backdoor as its final payload. All known victims are Ukrainian organizations in transportation, manufacturing, and energy sectors.
Starting October 7, 2026, attackers exploited two critical vulnerabilities in AhsayCBS backup utility (CVE-2026-105133 and CVE-2026-105134) to perform unauthenticated remote code execution. They chained these flaws to bypass authentication and execute code with SYSTEM privileges. Post-exploitation, attackers deployed JSP webshells, installed XMRig cryptocurrency miners disguised as Microsoft Edge processes, and used an AI-assisted PowerShell script to hide mining activity by terminating Task Manager. Persistence was maintained via a fake Windows service named MicrosoftEdgeUpdateSvc. Additionally, a vulnerable kernel driver (WinRing0x64.sys) was exploited for kernel-level hardware access to optimize mining. All AhsayCBS versions through 10.3.4 are affected, with managed service providers primarily targeted.
The npm package @galicia-toolkit-nestjs/commons contains a malicious native binary that collects sensitive environment variables related to cloud and CI credentials, along with system information, and exfiltrates this data to a hardcoded external server. The package mimics an internal organizational scope to trick users into installing it, and it persists by daemonizing a background process. Multiple published versions are affected, and no source code or build tooling is provided for the native component, making its behavior opaque.
The npm package css-overscroll-contain versions 1.0.0 through 1.0.3 contains malicious code that executes immediately upon module load. This code performs host reconnaissance, steals credentials and sensitive environment variables, probes container escape techniques, and exfiltrates data to a hardcoded attacker endpoint. The package masquerades as a CSS utility but is incompatible with legitimate functionality. Any system with this package installed should be considered fully compromised.
In July 2026, a sophisticated malware campaign attributed to the TraderTraitor group was uncovered, leveraging a trojanized Terraform provider to target cryptocurrency and Web3 developers. The attack uses a malicious Terraform provider that downloads a Bash loader from a HashiCorp-themed lookalike domain, which then deploys platform-specific payloads for macOS, Linux, and Windows. Encrypted executables are hidden in fake font files and decrypted with AES-256-CBC. The campaign delivers FLATROOF, a Rust-based backdoor with multiple command and control (C2) channels, and Python-based information stealers targeting browser credentials and cryptocurrency wallet data. The attack concludes with deployment of the ROOFDECK backdoor, which uses resilient C2 discovery methods including cryptographically signed Pastebin dead drops and Nostr metadata.
IDC Frontier's IDCF Cloud service in Japan suffered a ransomware attack on October 7, 2026, causing an outage in its East Japan Region 1 data center cluster. The attack disrupted services for 495 companies and local governments, leading to the shutdown of impacted systems and disabling of customer management console access. The threat actor claimed to have encrypted large volumes of data and virtual machine resources. IDC Frontier is investigating the attack, isolating affected systems, and verifying security before restoring access. A related outage at Nissui Corporation's logistics subsidiary due to suspected unauthorized access is under investigation, but a connection to the IDCF Cloud attack is unclear. Recent trends indicate increasing cybersecurity incidents targeting Japanese entities, with attackers exploiting access control and authentication weaknesses, possibly accelerated by AI tools. No patch or fix information is available as this is a ransomware incident affecting a cloud service.
A malware campaign named 'Midnight Mimosa' has been identified on low-cost Android smartphones. These devices come pre-installed with malicious firmware that enables attackers to silently install additional apps, conduct ad fraud, and convert the phones into residential proxies without user consent.
The npm package @kxafunc/xbails version 0.0.8 aliases its libsignal dependency to a non-standard package @bellaxchuu/libsignal-node using the mutable 'latest' dist-tag without version pinning or integrity checks. This allows whoever controls the upstream package @bellaxchuu/libsignal-node to push arbitrary code that executes within the Signal end-to-end encryption cryptographic path, potentially compromising identity keys, prekeys, and plaintext messages.
