The filipt package on PyPI contains malicious code that executes during installation by overriding the install command in setup.py. This behavior has been identified as malware, specifically a remote access trojan (RAT), by multiple security vendors. The affected versions are 0.1.0 through 0.1.5. There is no CVSS score available for this threat.
Gorbag is a Russia-aligned cyberespionage threat actor active since February 2025, targeting Ukrainian law enforcement, justice entities, local administrations near the front line, and defense sectors. The group uses spearphishing emails with malicious attachments to gain initial access and employs simple infostealers for rapid data collection, including browser credentials, VPN configurations, and selected documents. Their toolset includes Prime ReverseShell and BeautyStealer. In early 2026, Gorbag incorporated exploitation of CVE-2025-8088, a WinRAR path traversal vulnerability, into their attack chain. The group appears to focus on quick intelligence harvesting rather than long-term persistence, possibly acting as an initial access broker sharing credentials with other Russia-aligned actors.
Microsoft Threat Intelligence has identified a malware campaign that targets users seeking cracked software, free games, activators, and unofficial utilities. The campaign uses trojanized Inno Setup-style installers to deliver monetized software payloads via a multi-stage attack chain. These payloads include routing third-party internet traffic through infected devices, enrolling devices in distributed computing platforms, and installing utility software without user consent. The malware achieves persistence through scheduled tasks and operates silently, posing security and privacy risks to affected users.
The Haiou jailbreak bundle is a prompt package targeting OpenAI Codex that weakens model guardrails for security-related tasks such as hacking and software cracking. It functions as prompt adware by modifying Codex configuration files to inject advertisements for the author's LLM gateway service into agent responses. The bundle uses techniques like role-playing, context-reframing into CTF scenarios, and refusal suppression. It was found on a misconfigured webserver alongside tools like Cobalt Strike, VulnClaw agent, and Ladon framework, indicating active use by cybercrime actors. The freely distributed jailbreak serves as a channel to promote a paid gateway service, persistently injecting promotional content through encrypted payload files distributed via GitHub and Chinese platforms.
The gvmabc package on npm contains malicious code that compromises any computer on which it is installed or running. Full system compromise is likely, and all secrets and keys on the affected system should be rotated immediately from a separate, trusted device. Removing the package alone may not eliminate all malicious components due to potential persistent control by an attacker.
The y0syoh package on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a secure, separate machine. Removal of the package alone may not fully eliminate the malicious presence due to potential additional malware installed by the package.
The npm package 'wolce9' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious components or backdoors introduced by the package.
The npm package 'v36sl2' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'sgj0kx' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have gained full control of the system.
The s775oe npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure device. Removing the package alone does not guarantee full remediation as the attacker may have established persistent control over the system.
The npm package 'ru0z83' is identified as malicious software. Any system with this package installed or running is considered fully compromised. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised system. However, removal of the package alone may not eliminate all malicious components due to potential full control granted to an attacker.
The npm package 'rtvu6h' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software or control established by the attacker.
The qxjf8r npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as full control of the system may have been given to an attacker.
The npm package 'll3zea' contains malicious code that compromises any computer on which it is installed or running. This compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a separate, secure computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it, as the attacker may have gained full control of the system.
The ib3rwn package on npm contains malicious code that can fully compromise any computer on which it is installed or running. This compromise may allow an attacker to gain full control over the affected system, potentially exposing all stored secrets and keys. Immediate removal of the package is advised, but due to the extent of the compromise, removal alone may not eliminate all malicious software. Secrets and keys should be rotated from a different, secure computer.
The npm package 'bznio5' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may result in full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package and rotation of all secrets from a different, uncompromised system is strongly advised.
The npm package '3zqth8' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected machine should be rotated immediately from a different, secure computer. Removal of the package alone may not eliminate all malicious software introduced by it, as full control of the system may have been given to an attacker.
The npm package 'wxmzfq' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure machine. Removal of the package alone does not guarantee eradication of all malicious software introduced by it.
The g3ypjg npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious software, as the attacker may have gained full control of the system.
The npm package 'wyrj3i' contains malicious code that compromises any computer on which it is installed or running. Installation of this package may lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Immediate removal of the package is recommended, but complete remediation may require rotating all secrets and keys from a separate, uncompromised device due to potential persistent control by an attacker.
