The RubyGems package 'wallet-crypto-utils' version 1.0.0 and 1.0.3 contains malicious code in its native extension script that executes during gem installation. The code performs environment checks to evade sandbox and CI environments, then decodes and executes a payload that opens a reverse shell to a remote IP address. This allows an attacker to gain interactive shell access to the developer's machine, potentially compromising sensitive credentials and developer artifacts.
XWorm is a modular malware associated with the DDGroup cybercrime group. It uses multiple delivery methods such as phishing emails, drive-by downloads, exploit kits, USB drives, and RDP exploitation. The malware enables remote access, data theft including passwords and credit card information, ransomware deployment, spyware installation, and can cause system crashes and denial-of-service attacks. Its modular design and diverse attack vectors make it a persistent and multifaceted threat requiring continuous cybersecurity vigilance.
The RubyGems package 'crypto-mnemonic-tools' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes during gem installation. The script performs environment checks to avoid CI and sandbox environments, then after a delay, opens a reverse shell to a remote IP address, providing an attacker interactive shell access on the victim's machine. The malicious behavior is hidden behind a decoy Ruby library and uses a double-forked daemon process to evade detection.
The RubyGems package 'eth-keystore-utils' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes a hidden payload during gem installation. The payload establishes a persistent reverse shell to a hardcoded IP address, allowing remote command execution. The malicious code evades detection by checking for CI environments, sandbox indicators, and the presence of developer secrets before activating. The package was published on 2026-10-05 and targets Ethereum developers likely to have sensitive wallet and credential files.
The RubyGems package 'eth-address-utils' version 1.0.0 and 1.0.3 contains a malicious native extension script that executes a hidden reverse shell payload during installation. The payload activates only on developer workstations, avoiding CI environments and sandboxes, and connects to a remote attacker-controlled server to provide full remote code execution under the installing user's privileges.
This report details the recovery of a removed npm malware file from the scoped package @goodjavascript/dotenv@1.0.0 using archival sources and CDN metadata. The recovered file contained a timer-based mechanism that collects host information and can execute JavaScript from a server response. The package itself had no installation scripts and an empty exported config function. The recovery was achieved by correlating an older Software Heritage snapshot with a surviving SHA-256 digest from jsDelivr's file manifest. A Python verifier was developed to safely retrieve and hash the file without execution. This analysis supplements an existing OSV advisory and highlights the use of archival tools for malware investigation.
The npm package tostpro@100.2.0 contains a malicious preinstall script that executes automatically during installation. This script is obfuscated and designed to send the full environment variables, potentially including sensitive credentials, to a remote server after a specific date in 2026. The package's README falsely claims no network access or data collection, indicating deliberate evasion. This behavior poses a significant risk of credential leakage and unauthorized data exfiltration.
The npm package 'api-nebula' version 1.0.0 contains a malicious preinstall script that executes obfuscated JavaScript code during installation. This code uses a custom pseudo-random number generator and string-table decoder to conceal its true behavior, which includes executing arbitrary attacker-controlled code on the installer's machine. The obfuscation prevents static analysis from revealing network destinations or commands. Installing this package can lead to full system compromise, and any secrets or keys on the affected machine should be considered exposed and rotated immediately.
The npm package internallib_v275 version 1.0.3 contains malicious code that executes a reverse shell by fetching and running a payload from a hardcoded IP address. This allows remote attackers to gain interactive shell access on the host machine. The package uses an unauthenticated network retrieval without integrity verification, increasing the risk of compromise. Removal of the package alone may not fully remediate the infection due to potential persistence mechanisms.
The npm package @bellaxchuu/crystalred version 0.1.2 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries using the victim's own WhatsApp session. The target channels are obfuscated or dynamically fetched to evade detection. The malicious code does not steal credentials, maintain persistence, or execute arbitrary remote code.
The npm package @xatancchii/velycxbail version 1.1.0 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The targeted channel IDs are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's own WhatsApp session to increase subscribers for attacker channels but does not steal credentials, maintain persistence, or execute arbitrary code.
The saturn-baileys npm package (version 1.0.0) is a malicious fork of the Baileys WhatsApp Web library that injects covert subscription actions into the WhatsApp socket layer. Upon connection, it silently subscribes the victim's WhatsApp account to attacker-controlled channels without user consent by issuing authenticated FOLLOW queries. The target channels are obfuscated or dynamically fetched, allowing attackers to change targets post-installation. The malicious code abuses the installer's authenticated session but does not steal credentials, maintain persistence, or execute arbitrary code.
The npm package shadowmd version 8.6.87 is part of a large family of malicious forks of the Baileys WhatsApp Web library. These forks inject code that silently subscribes the victim's authenticated WhatsApp account to attacker-controlled channels without user consent. The target channels are obfuscated or dynamically fetched, and the malicious action abuses the installer's WhatsApp session to gain subscribers. The code does not exfiltrate credentials, establish persistence, or execute arbitrary remote code.
The anthropic-sdk package version 0.1.0 on PyPI contains malicious code that downloads and executes a remote script. It fingerprints the environment to detect sandboxing and delays execution before exfiltrating sensitive data such as credentials, environment variables, AI chat files, and SSH keys. If HTTPS exfiltration fails, it attempts DNS-based data exfiltration. The package also uses DNS to control execution centrally.
zencleaner versions 1.0.0, 1.0.3, and 1.0.3.1, advertised as local Windows cleaning tools with no telemetry or outbound calls, secretly send license keys, machine identity details, and public IP addresses to a hardcoded Discord webhook. Additionally, the software clears Windows event logs, including security logs, to evade forensic detection. These actions contradict the product's claims and pose privacy and security risks.
The virgil-cli npm package version 0.1.4 contains malicious behavior where it sends the entire conversation history, including potentially sensitive shell and file outputs, to a remote server without user consent. This occurs even in local mode, which is advertised as private. The package uses a hardcoded static token for authentication and allows remote command execution via a control server, which can be abused by attackers with network access. This behavior contradicts the privacy claims and poses a significant security risk.
The PyPI package 'caoxiltts' versions 0.1.0 and 0.1.1 contains malicious code that deploys a cryptocurrency miner instead of performing its advertised functions. This behavior is part of a campaign identified as 2026-10-voxeval, which involves malicious intent such as cryptomining. There is no CVSS score available for this threat.
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (4abc7154004498e9054ca8ac239acd73ab86815f6029ad5d52e4c883488f4c70)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (12f18950a276ca27a304d3053835b0102656168083e7ddf414fffb112cbe01ba)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer
---
_-= Per source details. Do not edit below this line.=-_
## Source: kam193 (28ef552864bd4b4558137163734077a2429281647a26868f40d8d735af95c967)
The package imitates real activity and instead deploys a coin miner.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-10-voxeval
Reasons (based on the campaign):
- cryptominer