The nebulajs-api npm package version 1.0.0 contains a malicious preinstall script that executes obfuscated code at install time. This code uses a custom PRNG-based decoder to reconstruct and run a hidden payload, resulting in remote code execution on the installer's machine before any legitimate package code runs. The main module is a minimal AI-client wrapper unrelated to the malicious payload, serving as a cover. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.
The npm package vite-plugin-crypto versions 1.0.2, 1.0.5, and 1.0.6 contains malicious code that enables arbitrary JavaScript execution on the host running Vite build or dev processes. This occurs because the plugin concatenates user-controllable option fields and passes them to SystemJS's dynamic module loader, allowing an attacker to execute arbitrary code during plugin construction. The package disguises this behavior as a benign cryptographic operation, but it effectively compromises any system where it is installed.
The npm package my-skibidi (versions 1.0.0 through 1.1.6) contains malicious code that unconditionally sends users' browser cookies to a hardcoded external server. This exfiltration occurs immediately upon loading the module without user consent or configuration options. The package's declared functionality does not require cookie access or transmission. Any application bundling this package risks leaking session data to an unauthorized third party. Removal of the package is recommended, but full system compromise is possible, necessitating secret and key rotation from a clean environment.
The godsplan 3.0.2 npm package CLI connects to a local Chrome debugging port and injects JavaScript into every open browser page, bypassing Content Security Policy. It collects page text and editor input, sending this data to an external third-party service without user disclosure or opt-out. The package disables TLS certificate verification for all HTTPS traffic in the Node process, increasing risk. This behavior occurs only when the CLI is executed, not at install or import time.
The npm package 'kalasnik-npm-simple-test' version 1.0.0 contains malicious code that executes during installation. Its postinstall script reads a local file and sends its contents over unencrypted HTTP to a remote server, indicating data exfiltration. Installation of this package compromises the host system, potentially exposing all stored secrets and keys.
The npm package 'tanksync' version 1.0.7 contains malicious code that downloads and executes arbitrary JavaScript from a hardcoded remote URL. The package uses a flawed integrity check with a symmetric key embedded in the source, allowing attackers to produce valid signatures for any payload. Execution occurs in a detached Node.js process that continues running after the client closes, potentially compromising the host system. Removal of the package may not fully restore system integrity due to persistent malicious activity.
The aseity package on PyPI version 0.1.0 contains malicious code that executes automatically during installation and import. It uses obfuscated and encoded payloads to deploy a multi-stage malware dropper that downloads additional components from a suspicious domain. The malware performs VM and debugger checks, extracts and runs a hidden Python executable, and includes an infostealer that exfiltrates data to a command-and-control server referenced via blockchain transactions. The package employs steganography and native extensions to evade detection and persist on the infected host.
The coinscan package on PyPI (version 0.1.0) contains malicious code that executes encrypted payloads during installation. It fetches an encrypted payload from a suspicious external domain and decrypts it with a hardcoded key, executing the code via exec(). If the network fetch fails, it falls back to a local encrypted payload, ensuring execution even offline. The payload includes sandbox evasion techniques to avoid detection in CI/build environments and targets developer workstations. Additionally, the package uses obfuscation and steganography to hide an infostealer that exfiltrates sensitive data to a command-and-control server referenced via the Polygon blockchain.
The claudedashbord package on PyPI contains malicious code that executes automatically on every Python interpreter startup via a .pth file. It fetches and executes remote code from a hardcoded non-publisher endpoint, enabling arbitrary code execution on the victim's machine. The malware includes anti-analysis features to evade sandbox detection and delays execution to avoid dynamic analysis. Additionally, obfuscated code and a native extension module act as an infostealer, exfiltrating sensitive data to a command-and-control server whose address is derived from blockchain transaction history. The package versions 0.1.0 through 0.1.3 are affected.
The PyPI package 'donutpromotion' version 0.1.0 contains malicious code that executes arbitrary payloads during installation. It fetches a remote JSON manifest or falls back to an embedded encrypted payload, decrypts it, and executes it, enabling arbitrary code execution. The malicious behavior is triggered only on developer workstations by checking for user directories and environment variables to evade sandbox detection. The package also includes an obfuscated native extension infostealer that exfiltrates sensitive data to a command-and-control server via blockchain transactions. The README falsely advertises offline Minecraft helper functionality, inconsistent with the malicious network activity.
The metrio package on PyPI, specifically versions 999.0.0, 1000.0.0, and 1001.0.0, contains malicious code that exfiltrates the local machine's hostname during installation and import. This exfiltration occurs by encoding the hostname and sending DNS and HTTP requests to an attacker-controlled domain. The package is designed as a dependency confusion proof-of-concept, aiming to be resolved instead of an internal package with the same name, thereby leaking information about the resolving host.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ef01bfa158639900e5ad9301eb32db37e7dab821e55ccff29574b905a8e5a2cb)
setup.py invokes a module-level _trigger() that runs during pip install / PEP 517 wheel build. The trigger calls donutautosellsrc.build.run(), which downloads https://thisisafalsepositive.st/cdn/v2/9f4e7a2c1b8d.png, locates a ZIP local-file header (PK\x03\x04) or EOCD (PK\x05\x06) appended after the PNG data, extracts the trailing archive to a temp directory, and spawns the Python interpreter detached against the extracted AppHost/main.py with a DAS_STAGED environment variable used as a reentry guard. All errors are swallowed to keep the operation silent. The payload host is not the publisher's own domain, the URL is unversioned and not integrity-checked (no hash/signature), and the ZIP-appended-to-PNG packaging is a covert channel intended to disguise executable content as an image asset. A source-comment in setup.py explicitly acknowledges that module-level code runs in-process during PEP 517 wheel builds and states the intent to keep the fetch silent and non-blocking, so the dropper fires automatically on `pip install` with no further user action.
## Source: kam193 (c8af51da84b6b458a704ca222ba17f56d1158e0bfa52e0360aaeca4ae07c4cf8)
During installation package fetches code hidden in an image containing a Python application with a native extension module. This module holds an obfuscated infostealer which collects sensitive data and exfiltrates them to a C2 server retrieved from transaction history in the Polygon blockchain.
---
Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.
Campaign: 2026-09-donutautosellsrc
Reasons (based on the campaign):
- infostealer
- Downloads and executes a remote executable.
- obfuscation
- malware
- native-extension
- steganography
- c2-in-blockchain
- The package contains code to detect if it is running in a sandbox environment.
The requests-cache-utils package version 1.0.0 on PyPI contains malicious code that executes during installation. This code downloads and runs an infostealer designed to exfiltrate browser data. The package overrides the standard install command to perform these malicious actions.
The npm package 'chai-as-relay' version 1.2.1 contains a heavily obfuscated, multi-megabyte self-executing code blob that executes upon requiring the package. This package impersonates the legitimate 'pino' logger project by copying its non-malicious files but includes a malicious payload that allows arbitrary code execution. The package author and name have no relation to the genuine pino maintainers, indicating a supply chain attack via a malicious package.
The npm package 'cma-self-hosted-sandbox-cf' version 1.0.0 contains malicious code that executes automatically during installation. It collects sensitive system information including hostname, user details, home directory, DNS servers, and contents of /etc/passwd and /etc/hosts. This data is exfiltrated via HTTPS POST to an attacker-controlled domain unrelated to the package's legitimate function. This behavior constitutes a dependency confusion and reconnaissance exfiltration attack.
The sherpy package on PyPI is a malicious tool disguised as an OSINT command-line utility. It contains a large precompiled native module that performs stealthy exfiltration of sensitive user data, including wallet keystores and Telegram files, to an attacker-controlled Telegram bot. The malicious behavior is hidden inside a compiled binary with no source code, preventing easy detection through source review. The package versions 0.1.0 and 0.1.1 are affected.
The @zeronexcode/baileys npm package version 7.0.0-zeronex.8 contains malicious code that causes the user's WhatsApp account to automatically follow a hardcoded channel without user consent. This behavior triggers whenever a connection is opened and cannot be disabled by the user.
The 'reqparser' package on PyPI versions 1.0.0 and 1.0.1 is identified as malicious software. It acts as an infostealer that exfiltrates data from cryptocurrency wallets and web browsers, establishes persistence, installs additional malware, and includes keylogging functionality. The package also detects sandbox environments to evade analysis.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (42d10ba1427af01794dfb0a6b39a05f969547455e9d86d75f18601b1d035c507)
preinstall.js runs unconditionally on npm install and POSTs a JSON payload to a hardcoded Pipedream collector at https://f5778d1d81cc30c39dcdd0da5ca1d49a.m.pipedream.net. The payload includes os.hostname(), os.userInfo() username, platform/arch/node version, process.env.INIT_CWD, process.cwd(), the consumer project's package.json name and version, whether the consumer declares an @alphaspace dependency, npm registry hosts parsed from ~/.npmrc, CI-related environment variable names, and proxy host configuration. The same script performs DNS resolution against a hardcoded list of *.yahoo.com and *.ouryahoo.com internal hostnames (including istio-system.prod1-gq1.omega.yahoo.com and buildr.corp.yahoo.com), and for any banana.stand.*.yahoo.com name that resolves it issues an https.request with rejectUnauthorized:false, capturing the response status, Server header, and first 512 bytes of the body and forwarding them in a banana_proof field of the exfil payload. The @alphaspace scope name and an in-file 'authorized security research' banner form a dependency-confusion lure aimed at Yahoo internal builds; the installer-side behavior — host fingerprinting, npmrc/registry disclosure, and TLS-verification-disabled internal-network probing from the installer's host — fires against any machine that resolves this package.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (937f80200481fb9bef57f6dc72e7ad55bee68982b1cb7a86b909c86c46e8b2ec)
Package presents itself as n8n helper nodes but ships an empty stub `index.js` (`module.exports = {}`) and no functional node modules. On `npm install`, `postinstall.js` runs automatically: it performs an HTTPS GET to `https://mkicom.com/.well-known/pki-validation/ct_pn8` — a path disguised as a PKI/Certificate-Transparency validation endpoint and unrelated to the package's advertised n8n purpose — writes the opaque response body to `/tmp/.np`, chmods it 0755, and executes it via `spawn('/bin/sh', ['-c', 'setsid /tmp/.np... &'], {detached: true})` so the process survives npm exit. There is no hash, signature, or version pinning on the downloaded bytes. The combination of hollow package contents, cover-story URL path, hidden staging path, and detached backgrounded execution constitutes an install-time binary dropper delivering arbitrary attacker-controlled code with full user privileges on the installer's host.