The npm package 'itsmeeaizat-bailey' includes a dependency on 'libsignal' fetched directly from a GitHub repository without version or integrity constraints, allowing the code executed during installation to change unpredictably. Additionally, the package contains an undocumented behavior that, about 90 seconds after a WhatsApp session opens, automatically issues a follow request to a hardcoded newsletter ID owned by the package author. This action uses the installer's authenticated WhatsApp identity without explicit consent. No credential theft, data exfiltration, backdoors, or destructive actions are present in the code.
The npm package tailwind-forms-kit@0.5.1 impersonates the legitimate @tailwindcss/forms plugin by using a misleading package name with a leading space, copying the README, and pointing its repository field to the legitimate source. However, its main entry point contains obfuscated code that dynamically fetches and executes arbitrary code from blockchain-hosted transaction data tied to a hardcoded Ethereum address. This allows an attacker controlling that address to execute arbitrary code on any host that installs or requires this package, bypassing typical domain or URL blocklists.
The mfahelper npm package version 1.0.0 includes a malicious dependency that fetches code from an unrelated GitHub repository's main branch without version pinning or integrity verification. This allows arbitrary code execution during installation and runtime, leading to full system compromise. Removal of the package does not guarantee elimination of the malicious payload. Immediate secret and key rotation is recommended.
The npm package web-vitals-polyfill-core-v1 version 1.0.0 is a malicious package masquerading as a legitimate web-vitals polyfill. It contains obfuscated code designed to hijack end-user navigation by loading a service worker that redirects users to attacker-controlled destinations resolved dynamically via DNS-over-HTTPS and fallback paste sites. The package lacks any legitimate library code and is intended to compromise any system where it is installed. Systems with this package installed should be considered fully compromised.
The npm package @chatunity/baileys versions 3.2.0 and 3.2.1 include a runtime dependency on libsignal from an off-registry GitHub repository without commit SHA or tag pinning. This creates a risk of arbitrary code execution during npm install if the repository content changes or if the repository owner account is compromised, due to the mutable and integrity-unchecked dependency.
The PyPI package 'queeuees' version 0.0.1 contains obfuscated malicious code that executes at import time. The package ships two similarly named top-level packages with identical payloads that decode and execute hidden code via complex byte transformations. This code modifies the system by iterating over Python files and adding comments without user consent. The package metadata misleads users by advertising itself as a basic calculator. The obfuscation and unauthorized system modifications indicate clear malicious intent.
The npm package 'sk-lib-enc' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package does not guarantee elimination of all malicious software introduced by it. Immediate rotation of all secrets and keys from a different, uncompromised computer is strongly recommended.
The npm package @xoxo-momo/kit contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted device. Removing the package alone may not fully eliminate the malicious presence, as the attacker may have established persistent control.
The npm package @hrmony/hyper-json-builder version 1.99.0 contains malicious code that, upon loading, contacts a hardcoded attacker-controlled endpoint to exfiltrate sensitive information. It harvests environment variables, Kubernetes secrets, and AWS EC2 instance metadata credentials, sending these to the attacker. Any system with this package installed should be considered fully compromised, and all secrets should be rotated immediately. Removal of the package alone may not eliminate the compromise.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (6457aa73ec15f68e06005977033aaba349467d40e3d406f0810684a43b74fcb5)
The package's preinstall script and its main entry (index.js) both perform identical credential-harvesting: they query the EC2 Instance Metadata Service (IMDSv2) at 169.254.169.254 for the identity document and IAM role security credentials, enumerate the entire process.env, and recursively read /var/run/secrets/ (Kubernetes service-account tokens and mounted secrets). The collected data is POSTed to a hardcoded attacker-controlled host at hrnmn.dd.h4x.tv (paths /save_instance_info_hook from preinstall and /save_instance_info_index from index.js). The destination is unrelated to any legitimate package purpose, there is no user configuration, and the behavior fires automatically on `npm install` via the preinstall lifecycle hook as well as on any `require()`/`import` of the package. The harvested material — temporary AWS IAM credentials, cloud instance identity, arbitrary environment variables (which routinely contain API keys, tokens, and database credentials in CI/build environments), and Kubernetes service-account tokens — grants immediate cross-service access to the installer's cloud and cluster resources.
## Source: ghsa-malware (07386b2d1e2efa71fd38c591953684c11302ad77f1c7943bd542b71fd83184e3)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package @hrmony/benefit-essenszuschuss (version 3.99.0) contains malicious code that, upon import, harvests cloud and container secrets from the host environment. It retrieves AWS IAM role credentials via the Instance Metadata Service (IMDSv2), collects environment variables, and reads Kubernetes secrets from the filesystem. This sensitive data is then exfiltrated to a hardcoded attacker-controlled endpoint. The package mimics an internal HR utility and includes an unpinned dependency, facilitating a dependency confusion attack. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/account-management version 1.99.0 contains malicious code that executes upon import. It collects sensitive AWS instance metadata, environment variables, and Kubernetes secrets, then exfiltrates this data to an attacker-controlled server. This package is part of a dependency confusion or scope-squatting attack targeting an internal npm scope. Systems with this package installed should be considered fully compromised, and all secrets must be rotated immediately.
The npm package @hrmony/app-gateway-templates (version 0.0.51) contains malicious code that exfiltrates sensitive AWS instance metadata, IAM credentials, environment variables, and Kubernetes secrets to an attacker-controlled endpoint. The package is a typosquat of 'harmony' and also pulls in additional attacker-controlled dependencies. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @hrmony/interfaces (version 0.99.0) contains malicious code that executes upon import or require. It collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, and Kubernetes secrets, then exfiltrates this data to a hardcoded external server. This behavior is consistent with a dependency confusion attack. Systems with this package installed should be considered fully compromised, and all secrets should be rotated immediately.
The npm package @hrmony/benefit-internetzuschuss (version 1.99.0) contains malicious code that, upon import, sends AWS instance metadata, environment variables, Kubernetes secrets, and IAM credentials to a hardcoded external attacker-controlled server. This package masquerades as a German social-benefits helper but performs unauthorized credential harvesting. Systems with this package installed should be considered fully compromised.
The npm package @hrmony/cdk-constructs contains malicious code that executes immediately upon import or require. It harvests AWS EC2 instance metadata, including IAM role credentials, environment variables, and Kubernetes secrets, then exfiltrates this sensitive information to a hardcoded external server. The package is a typosquatting attempt targeting developers seeking legitimate AWS CDK constructs under the @harmony scope. It also installs an additional attacker-controlled dependency. Systems with this package installed should be considered fully compromised, and all secrets must be rotated immediately.
The npm package @hrmony/benefit-mobilitaet version 1.99.0 contains malicious code that, upon loading, contacts the EC2 Instance Metadata Service to retrieve sensitive instance identity and IAM role credentials. It also enumerates environment variables and Kubernetes secrets, then exfiltrates all collected data to a hardcoded attacker-controlled endpoint. This behavior indicates a dependency-confusion attack pattern and results in full compromise of any system running this package.
The npm package @hrmony/organisationsverwaltung version 7.99.0 contains malicious code that executes immediately upon import or require. It exfiltrates AWS IAM credentials, environment variables, and Kubernetes secrets by sending them to a hardcoded external server. This package is a dependency-confusion attack targeting an internal namespace. Systems with this package installed should be considered fully compromised, and all secrets should be rotated from a clean environment.
The npm package @hrmony/benefit-sachbezug (version 1.99.0) contains malicious code that executes upon import or require. It collects sensitive AWS EC2 instance metadata, IAM role credentials, environment variables, Kubernetes secrets, and user data, then sends this information to a hardcoded attacker-controlled endpoint. This behavior effectively compromises any system running the package, risking exposure of all stored secrets and keys.
The npm package @hrmony/benefitverwaltung version 1.99.0 contains malicious code that exfiltrates sensitive data from the host system. Upon import, it sends identifying information to a suspicious external domain and harvests AWS instance metadata, environment variables, and Kubernetes secrets. This activity compromises the security of any system running the package, potentially exposing all stored secrets and credentials.