The 'that-fetch' npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different machine. Removing the package alone does not guarantee removal of all malicious software, as full control may have been given to an external attacker.
The filipt package on npm contains malicious code that compromises any computer on which it is installed or running. Full control of the affected system may be given to an outside entity, risking exposure of all stored secrets and keys. Immediate removal of the package and rotation of all secrets from a different, uncompromised computer is strongly advised.
The extera-runtime package on PyPI version 1.1.0 contains malicious code designed to exfiltrate sensitive Telegram files. The malicious functionality includes executing remote commands on the victim's machine, likely limited to a specific set of commands. The malicious code does not start automatically, indicating possible manual activation or trigger conditions. This package is part of a campaign identified as 2026-11-extera-plugin-runtime with clear malicious intent targeting Telegram data.
The npm package @pasqua-baileys/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone may not fully eradicate the malicious presence, as the attacker may have established persistent control.
The npm package @realvare/baileys contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, clean computer. Removing the package alone may not eliminate all malicious software, as full control of the computer may have been granted to an attacker.
The npm package '@realvare/based' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control over the system.
The npm package @fyxzpediaa/libsignal is identified as containing malicious code. Any system with this package installed or running is considered fully compromised, with potential unauthorized control by an attacker. Immediate rotation of all secrets and keys stored on the affected system is recommended. Removal of the package alone may not eliminate all malicious components due to possible persistent control established by the attacker.
The msgpackrpc package on PyPI contains malicious code that exfiltrates basic host information such as IP address and username upon installation or import. The package overrides the install command in setup.py to execute this malicious code. It serves no legitimate purpose beyond this data exfiltration.
The npm package @ai-ecoverse/slicc-windows-amd64 version 1.46.4 contains malicious code that fully compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The extera-plugin-runtime package on PyPI contains malicious code designed to exfiltrate sensitive Telegram files. The malicious functionality includes executing remote commands on the victim's machine, though it does not start automatically. This package is part of a campaign with clear malicious intent targeting Telegram data.
The npm package 'screenshot-desktop' version 1.16.0 contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, clean computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package @ifasn/ms-doc-mcp, advertised as a Markdown toolkit, contains malicious code that probes the Alibaba Cloud instance metadata service to harvest temporary IAM credentials and other sensitive instance metadata. This harvested data is output to stdout and a local file, potentially exposing credentials beyond the local host. The behavior is unrelated to the package's declared functionality and poses a risk of credential leakage.
The w002yardprobe RubyGem contains malicious code that executes during YARD documentation generation. It runs a script that collects host identifiers and exfiltrates them to a third-party URL. The script also modifies files in the build environment and leaves sentinel files indicating its activity. The malicious behavior triggers when documentation is generated, affecting developer workstations, CI runners, or documentation hosting services that process the gem's docs.
The brida-frida-hooks RubyGem version 1.0.1 contains malicious code that executes automatically during installation. This code collects sensitive system information including user identity, directory paths, hostname, and contents of critical system files, then exfiltrates this data over an encrypted connection to a hardcoded external server. This behavior is unrelated to the gem's stated purpose and occurs without user consent.
The yzx-npm package versions 1.0.0 and 1.0.1 contain malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Removal of the package alone may not eliminate all malicious components, as the attacker may have established persistent control.
The npm package 'mocha-ui-themes' contains malicious code that can fully compromise any computer on which it is installed or running. The compromise may allow an attacker to gain full control over the system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the severity of the compromise, simply removing the package may not eliminate all malicious software. Secrets and keys should be rotated from a different, trusted machine.
The tailwind-form-core npm package contains malicious code that compromises any computer on which it is installed or running. The presence of this package indicates a full system compromise, requiring immediate rotation of all secrets and keys from a different, uncompromised machine. Simply removing the package does not guarantee removal of all malicious software introduced by it.
The npm package react-contact-forms contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The tailwind-input-kit npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The npm package 'jito-bundle-tip-7' contains malicious code that fully compromises any computer on which it is installed or running. The compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, complete remediation may require rotating all secrets and keys from a separate, uncompromised machine.