The npm package @adminide-stack/health-api-server version 0.0.18-alpha.465 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised device. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
The npm package @adminide-stack/client-redux version 0.0.16-18 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package @adminide-stack/utils version 0.0.16-130 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'mock-datas-lib' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'kvarzo-8f3a2-testmetest' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, uncompromised device. Removal of the package alone may not eliminate all malicious software introduced by its installation, as the attacker may have gained full control of the system.
The data-sync-utils npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate the threat, as the attacker may have established persistent control over the system.
The 'that-fetch' npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different machine. Removing the package alone does not guarantee removal of all malicious software, as full control may have been given to an external attacker.
The filipt package on npm contains malicious code that compromises any computer on which it is installed or running. Full control of the affected system may be given to an outside entity, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised computer is strongly advised.
The extera-runtime package on PyPI version 1.1.0 contains malicious code designed to exfiltrate sensitive Telegram files. The malicious functionality includes executing remote commands on the victim's machine, likely limited to a specific set of commands. The malicious code does not start automatically, indicating possible manual activation or trigger conditions. This package is part of a campaign identified as 2026-11-extera-plugin-runtime with clear malicious intent targeting Telegram data.
The npm package @pasqua-baileys/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
The npm package @realvare/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone may not eliminate all malicious software, as full control of the computer may have been granted to an attacker.
The npm package '@realvare/based' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control over the system.
Between late September and early October 2026, seven South Korean financial institutions were breached, impacting around 66,000 individuals and 2,200 corporations. The attacks were linked to ARTEX, an AI-driven autonomous penetration testing framework. Investigations uncovered exposed infrastructure hosting AI model-routing components, exploitation tools, and proxy management utilities. The operation leveraged multiple AI models and included various attack artifacts such as reconnaissance tools, exploitation chains, privilege escalation exploits, and scripts targeting cryptocurrency exchanges and mobile devices. The infrastructure spanned multiple countries with over 1,300 IP addresses identified.
The npm package @fyxzpediaa/libsignal is identified as containing malicious code. Any system with this package installed or running is considered fully compromised, with potential unauthorized control by an attacker. Immediate rotation of all secrets and keys stored on the affected system is recommended. Removal of the package alone may not eliminate all malicious components due to possible persistent control established by the attacker.
The msgpackrpc package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious code. It serves no legitimate purpose beyond this data exfiltration.
The npm package @ai-ecoverse/slicc-windows-amd64 version 1.46.4 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The extera-plugin-runtime package on PyPI contains malicious code designed to exfiltrate sensitive Telegram files. The malicious functionality includes executing remote commands on the victim's machine, though it does not start automatically. This package is part of a campaign with clear malicious intent targeting Telegram data.
The npm package 'screenshot-desktop' version 1.16.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
This threat involves a malware campaign using business-themed email lures to deliver XLoader and other payloads. The attack starts with emails containing RAR archives with obfuscated JScript files that extract and execute a LuaJIT interpreter and loader. The loader performs in-memory execution of the XLoader core via manual mapping and shared-section injection into target processes. The malware steals credentials including Windows Vault data and browser cookies and communicates with multiple command-and-control servers. Additional malware such as Agent Tesla, Remcos, and XWorm are also delivered in this campaign.
A large-scale watering hole campaign attributed with moderate-to-high confidence to APT29 targets mobile devices by compromising legitimate websites, impersonating high-profile domains, and supply-chain compromising a Ukrainian analytics service. The campaign uses injected JavaScript to profile devices and deliver platform-specific n-day exploits against iOS and Android. Exploited vulnerabilities include multiple CVEs from 2024 to 2026. The final payloads exfiltrate sensitive data such as browser cookies, Wi-Fi passwords, and device information without establishing persistence, consistent with intelligence-gathering objectives.
