The npm package '@firelordzuka/pulse-poc' contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the affected system. Immediate removal of the package is advised, but due to the potential for persistent malicious software, complete remediation may require additional measures. All secrets and keys stored on the compromised system should be rotated from a separate, secure device.
The npm package 'link-status-page' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, trusted machine. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control over the system.
The npm package 'link-age-great' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee the removal of all malicious software or backdoors introduced by this package.
The npm package '@redman89405/my-module' contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removing the package alone may not eliminate all malicious software introduced by the package, as full control of the system may have been granted to an attacker.
The npm package 'runhelper' version 1.0.0 contains malicious code that, upon being required, loads and executes a native payload disguised as a .jpg file. This payload is staged by its dependency 'imgbundle' and executed in-memory on Windows systems using kernel32 API calls via the 'koffi' FFI. The payload file is deleted after execution, and the module suppresses all errors, hiding its true behavior. The advertised functionality is a cover story; the actual behavior is the execution of attacker-supplied native code in-process.
The npm package 'iban-validator-js' contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, and all secrets and keys stored on the affected machine should be rotated immediately from a separate, secure device. Removing the package alone may not eliminate all malicious software introduced by its installation.
The npm package 'focaleys' version 1.1.0 declares a dependency on 'libsignal' via a GitHub repository reference without specifying a fixed tag, version, or commit SHA. This means that on installation, the dependency resolves to the current default branch HEAD of the repository, executing any lifecycle scripts present there on the installer's machine. Control of the GitHub account 'rexxzyid' thus allows an attacker to run arbitrary code during installation of 'focaleys', potentially changing silently between installs without modifying the 'focaleys' package itself.
The npm package 'fca-raihan' versions 37.2.5 and 37.2.6 declare a dependency on themselves via an off-registry GitHub source without a pinned reference or integrity check. This allows the repository owner to change the installed code at any time, potentially introducing malicious code during installation. The package includes base64 decoding and references consistent with its advertised messaging and end-to-end encryption functionality, but these are not independently verifiable without examining the mutable GitHub source at install time.
The npm package exiouss version 5.0.1 contains malicious code that imports the child_process module and sends POST requests to hardcoded endpoints, including a public Google domain and a non-resolvable internal domain likely used for attacker command and control. The code also repeatedly invokes ping commands, indicating potential active data exfiltration or reconnaissance behavior. This activity is inconsistent with normal HTTP client operations and suggests the package has been compromised to perform unauthorized network communication.
The npm package 'imgbundle' versions 1.0.0 and 1.0.1 contains malicious code that does not perform its advertised image bundling function. Instead, it decrypts an AES-256-CBC encrypted file from a sibling dependency 'cdn-img-fetch' using a hardcoded key, writes the decrypted content to disk, deletes the original encrypted file, and sets up a file watcher to repeat this process if the encrypted file reappears. This behavior effectively makes 'imgbundle' a staged dropper that materializes attacker-controlled content on the filesystem at import time, contrary to its stated purpose.
The contoso-login-sim-loader npm package contains a malicious payload concealed as an RC4-encrypted base64 blob that decrypts and executes in the browser at runtime. It employs anti-analysis techniques such as detecting developer tools and disabling console logging to evade detection. The package lacks source code, dependencies, or documentation, and its deceptive naming and description suggest it may serve as a fake login or credential-harvesting overlay when included in websites. This behavior poses a risk of embedding attacker-controlled JavaScript into affected sites, potentially compromising end users.
The npm package cdn-img-fetch versions 1.0.0 and 1.0.1 unconditionally downloads a file from a mutable third-party GitHub repository at module load time and writes it to a hidden temporary file on the installer's system. This behavior occurs automatically upon import without user interaction and does not verify the source content's integrity. The package's advertised functionality does not justify this import-time network fetch and hidden file write, indicating malicious intent as a first-stage dropper mechanism.
The PyPI package 'cleanup-string' version 1.0.0 includes a suspicious Windows-only native extension protected by VMProtect, a tool used to obfuscate and virtualize code to prevent analysis. Although the package claims to be a pure-Python string helper, it loads a large opaque binary module with no clear legitimate purpose. This module executes with the privileges of the importing process in any Windows Python 3.13 environment, potentially enabling malicious activity.
The cortana-md-engine npm package contains hardcoded MongoDB credentials that allow the package author to access WhatsApp session data from installed bots. This access enables potential hijacking of linked WhatsApp accounts. Additionally, the package includes offensive tools for abuse against third-party WhatsApp users, such as proxy pools and commands for flooding and banning. The malicious functionality is not disclosed in the README, misleading users about the package's true behavior.
The npm package chaienv version 1.0.2 contains a large obfuscated JavaScript payload disguised as a small Chai environment helper. The package loads a 4.4MB single-line obfuscated module that does not match the advertised functionality and includes decoy files mimicking a legitimate project to evade casual inspection. Any user importing this package executes the opaque code, which poses a risk of malicious behavior.
The npm package 'booking-eligibility' version 1.0.0 contains a malicious postinstall script that attempts to execute a Windows Script Host (WSH) VBScript file named '4444.vbs' during installation. This script is not included in the package tarball, meaning the hook either fails or could execute attacker-supplied code if the file is provided by other means. The package's README falsely claims there are no installation scripts, misleading users about its behavior. The '4444.vbs' filename suggests a potential reverse-shell payload, indicating malicious intent. The package does not provide legitimate functionality to justify this behavior.
The npm package 'developmentstelemetry' contains malicious code that executes arbitrary code during installation. Its postinstall script runs a small stub that dynamically imports and executes a function from an unaudited third-party package 'originaldevelopmentstelemetry@1.2.2', which downloads and runs an update payload on the installer's machine. This behavior effectively hands control to the external package author during every 'npm install'.
The npm package 'booking-tasks' version 1.0.2 contains a malicious postinstall script that executes a VBScript payload on Windows systems. This payload decrypts and runs a PowerShell loader via process hollowing, enabling arbitrary code execution on the host. The package's declared functionality contradicts the presence of this malicious installation script, indicating the main module acts as a decoy. The payload uses multiple cryptographic primitives and chunked Base64 encoding to evade static detection.
The bfox-build-utils Python package (version 1.0.997) contains malicious code in its setup.py script that steals GitHub credentials during installation. It uses these credentials to clone the installer's repository, create a new branch, and inject a persistent attacker-controlled GitHub Actions workflow. This workflow executes on future pushes to the planted branch, enabling ongoing unauthorized actions. The package itself appears innocuous, with a minimal Python module and misleading branch and commit names to conceal the malicious behavior.
The test-supply-npm-lib-4 package declares a dependency via a git URL pointing to a GitHub repository controlled by an individual account rather than the official npm registry. This dependency includes lifecycle scripts, such as a prepare hook, that run automatically during npm install. Because the code is fetched directly from GitHub and not vetted through the npm registry, it poses a risk of executing malicious code on the installer's machine.