The echogen package on PyPI version 1.0.0 contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious behavior. It serves no legitimate purpose beyond this data exfiltration.
The PyPI package 'voxcpmtts3' versions 0.1.0, 0.1.1, and 0.1.2 contains malicious code that impersonates legitimate activity but actually deploys a cryptocurrency miner. This behavior is part of a campaign identified as 2026-10-voxeval, which has clear malicious intent. There is no CVSS score available for this threat.
The voxel-tts package on PyPI versions 0.5.0 and 0.5.1 contains malicious code that deploys a cryptocurrency miner instead of its advertised functionality. This is part of a campaign identified as 2026-10-voxeval with clear malicious intent.
The voxeval package on PyPI versions 0.4.2 through 0.4.5 contains malicious code that deploys a cryptocurrency miner instead of providing legitimate functionality. This is a malicious campaign identified as 2026-10-voxeval with clear intent to misuse victim resources for cryptomining.
The npm package 'ui-base-colors' contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'translate-base-font' contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package 'ui.dist.min.js' contains malicious code that compromises any computer on which it is installed or running. Systems with this package should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious software introduced by the package.
The npm package '@smwebserver/static' version 99.9.1 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain known for malicious activity. There is no CVSS score available, and no known exploits in the wild have been reported. No official patch or remediation information is provided.
The dedh-devops-automation package on PyPI contains malicious code that executes during installation. It deploys a rogue AWS Lambda function designed to collect credentials from AWS Secret Manager and exfiltrate sensitive data. The package overrides the install command in setup.py to perform these malicious actions. Multiple versions of the package are affected, including 0.0.1, 5.0.0, 5.6.0, 5.6.1, 5.6.999, 5.8.0, 5.8.1, and 5.9.0. This campaign is identified as having clear malicious intent, targeting cloud tokens and credentials.
The npm package 'kartykgithub-ph-f' version 1.0.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software or restoration of system integrity.
The spo365-graph package on PyPI contains malicious code introduced in version 1.1.2 that executes during installation. This code deploys a rogue AWS Lambda function designed to collect credentials from AWS Secret Manager and exfiltrate other sensitive data. The package overrides the install command in setup.py to carry out these malicious actions.
This package is part of a large family (100+ identified as of September 2026) of near-identical
forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into
the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW
query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter
JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the
victim's account to channels it never asked to join.
The target JID(s) are hidden from casual source review via one of several obfuscation techniques
observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code
array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote
JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change
after installation without a new npm publish. Every sample in the family shares the same underlying
mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after
connect), even though the package name, JID value(s), and obfuscation/delivery method differ per
fork.
The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and
subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish
persistence, or execute arbitrary remote code.
Affected package: @kelvdra/baileys (npm), version(s): 1.0.6-rc.1, 1.0.6, 1.0.5-rc.3.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (839545967c959062f79d5b217758730bd2c6a69219949c2eea494e75e3cfc12a)
package.json in @kelvdra/baileys@1.0.6-rc.4 declares the dependency `libsignal` as `github:Kelvdra/libsignal` with no version, tag, or commit SHA. On `npm install`, npm resolves this specifier to the current tip of the referenced repository's default branch and installs whatever bytes it returns, running any lifecycle scripts contained within them, with no integrity check. The dependency source is not the npm registry and not a pinned commit, so the code that lands on the installer's machine can change at any moment without any change to this package. Control of that GitHub account or repository translates directly into install-time code execution on every installer of this package.
This package is part of a large family (100+ identified as of September 2026) of near-identical
forks of the Baileys WhatsApp Web library that inject a covert channel-subscription action into
the WhatsApp socket layer. On connect, the injected code issues an authenticated `w:mex` FOLLOW
query (query_id 7871414976211147) against one or more attacker-chosen WhatsApp Channel/Newsletter
JIDs, using the installer's own authenticated WhatsApp session -- silently subscribing the
victim's account to channels it never asked to join.
The target JID(s) are hidden from casual source review via one of several obfuscation techniques
observed across the family: a plain string literal, base64 encoding, base64+XOR, or a char-code
array reconstructed at runtime. Some variants instead fetch a mutable, attacker-controlled remote
JSON/JS list of target JIDs from GitHub or another host at runtime, letting the target list change
after installation without a new npm publish. Every sample in the family shares the same underlying
mechanism (a wrapped/patched socket-connect routine that fires the FOLLOW query some seconds after
connect), even though the package name, JID value(s), and obfuscation/delivery method differ per
fork.
The malicious action abuses the installer's own authenticated WhatsApp session to gain reach and
subscribers for attacker-controlled channels; it does not exfiltrate credentials, establish
persistence, or execute arbitrary remote code.
Affected package: @bottino/baileys (npm), version(s): 1.0.14, 1.0.13, 1.0.12, 1.0.11, 1.0.10, 1.0.9, 1.0.8, 1.0.7, 1.0.6, 1.0.5, 1.0.2, 1.0.1.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (571d52cf3274d95d4824667269921b2e0ad1478fe9f324a74fab0ba377bb9a26)
This fork of Baileys overrides `requestPairingCode` so that when the caller does not supply an explicit `pairKey`, `authState.creds.pairingCode` is set to the fixed literal string `BYPAKI64`. That value is then used as the KDF input for the WhatsApp companion-device link-code encryption via `derivePairingCodeKey(authState.creds.pairingCode, salt)`. Because the pairing code is a known constant baked into the package, anyone who knows the target phone number of the installer's WhatsApp account can complete the companion-device pair flow from a device they control and obtain persistent access to the installer's WhatsApp session (read/send messages, contacts, media) — a full account takeover backdoor against any application built on this library. Additionally, on socket connect the code auto-subscribes the installer's WhatsApp account to a hardcoded newsletter JID `120363418582531215@newsletter` and persists a `basedbysam` flag so the covert subscribe runs once per credential store; this covert action uses the installer's WhatsApp identity without disclosure.
friendly-tools 0.2 carries the same Snowflake payload as friendly-greeting-tools. Its --run-demo option, described as a print-only demo, execs a gzip and base64 blob from friendly_greeting/main.py that reads the container session token at /snowflake/session/token, switches to ACCOUNTADMIN and copies a table into s3://pkusinski-external/ through a new storage integration.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (71b3a4955d5bd8448f0a56c843936702bb1f09eb8acbb9b468a5a337f8761b7f)
The package presents itself as 'Small greeting utilities' but ships two gzip+base64 embedded blobs (DEMO_EN, DEMO_ST) in main.py that are decoded and passed to exec() through the documented public API run_demo(). The decoded Python has no relation to greetings: it opens /snowflake/session/token to read the installer's Snowflake OAuth session token, calls snowflake.connector.connect with authenticator='oauth' and role='ACCOUNTADMIN', then issues DDL that creates an external S3 stage at s3://pkusinski-external/ using STORAGE_AWS_ROLE_ARN='arn:aws:iam::631484165566:role/pentests_s3_role', and runs COPY INTO @ROGUE.ROGUE.ext_stage FROM ROGUE.ROGUE.TEST_USERS to egress data to that non-first-party S3 bucket. When run_demo() is invoked in a Snowpark or Streamlit-in-Snowflake environment where /snowflake/session/token is provisioned, the installer's Snowflake credential is consumed under ACCOUNTADMIN to copy Snowflake table data to attacker-controlled storage. The obfuscation (gzip+base64+exec), the cover-story package description, and the hardcoded attacker S3 bucket and IAM role are consistent with a Snowflake-targeted data-theft payload.
## Source: kam193 (969afb49a1e59fa643e9d90d07745e3957906cc9603c4e5643e5760d5f254381)
The package contains obfuscated code to exfiltrate data from the environment, targeting primarily Snowflake databases and credentials to them. Some tracks suggest it may be part of a pentest.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-friendly-greeting-tools
Reasons (based on the campaign):
- exfiltration-generic
- obfuscation
The @hanzofc/baileys npm package versions 7.0.0 and 7.0.1 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert follow query into the WhatsApp socket connection, leveraging the installer's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The @japofc/baileys npm package, a fork of the Baileys WhatsApp Web library, contains malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is done by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package @lendkzn/xntaabail version 7.0.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or fetched dynamically, and the malicious action uses the installer's own WhatsApp session to perform the subscription. This behavior does not involve credential theft, persistence, or arbitrary code execution.
The npm package @noxleyss/baileys version 1.1.10 is part of a family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The subscription targets are obfuscated or dynamically fetched, making detection difficult. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @nyzzpedia/baileys-new version 1.0.0 is a malicious fork of the Baileys WhatsApp Web library. It injects code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing an authenticated FOLLOW query using the victim's own session. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. This behavior does not steal credentials, maintain persistence, or execute arbitrary code.
The @queenanya/baileys npm package versions 9.10.1, 9.7.3-beta.1, and 9.7.2 contain malicious code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent. This is achieved by injecting a covert FOLLOW query into the WhatsApp socket connection using the installer's authenticated session. The targeted channel identifiers are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code does not steal credentials, maintain persistence, or execute arbitrary code.