The npm package upload-to-gcp version 3.2.1 contains malicious code that executes a postinstall script during installation. This script collects host system identifiers and environment details, then sends this data to a suspicious external domain unrelated to Google Cloud Platform. This behavior occurs without user consent or disclosure, indicating a privacy and security risk.
The Cookie Banner for GDPR / CCPA – WPLP Cookie Consent plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'regionArray' parameter in all versions up to, and including, 4.3.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Successful exploitation requires that the site administrator has enabled the 'Support Google Consent Mode (GCM)' setting, which is disabled by default. Additionally, the AJAX handler performs no nonce or capability check, allowing any authenticated user including those with Subscriber-level access to overwrite the affected plugin setting.
A high-severity vulnerability (CVE-2026-41349) in the openclaw-cli package allows a large language model (LLM) agent to bypass agentic consent by silently disabling execution approval via the config.patch mechanism. This issue affects versions from 2026.1.29 up to but not including 2026.3.28. The vulnerability has been fixed in version 2026.3.28 and later.
The npm package ms_aidc_com_tw (version 1.0.0) contains malicious code that impersonates a Microsoft-branded Taiwanese domain and serves a fake Cloudflare Turnstile security verification page. Upon user interaction, it executes heavily obfuscated JavaScript to redirect victims to the legitimate Microsoft login page with attacker-controlled parameters, enabling OAuth-consent phishing. Installing or running this package may fully compromise the affected computer, risking exposure of stored secrets and keys.
The biklimaster npm package contains malicious code that, upon installation on Windows, creates a hidden local administrator account with a known password and enables Remote Desktop Protocol (RDP) access with insecure settings. This includes disabling Network Level Authentication and enabling session shadowing without user consent. The package executes unsigned Windows binaries to patch system files and configure the system for remote access. Because the admin password is publicly known and the package is publicly available, any system with this package installed is at high risk of compromise.
The npm package whs4_ued version 1.0.0 contains malicious code that executes during installation. Its postinstall script runs a Node.js script that sends sensitive host information, including the absolute path of the package file (revealing OS username and home directory structure), Node.js version, platform, and architecture, to an attacker-controlled Discord webhook without user consent.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (88f51898e05da09842f561ce72f06378a6718f778fa0335b68bb4c0fda8cc5a6)
On module load, tokocrytodev instantiates a StealthC2 agent and starts a polling loop that fetches commands from https://badai.run.place/cekapppiapi.php?uid=<host-id>, passes each response body to child_process.exec, and POSTs AES-256-ECB-encrypted stdout/stderr back to https://badai.run.place/fallback.php — giving the operator of that endpoint arbitrary remote command execution on any host that require()'s the package. In parallel, stealKeysAsync shells out `find` over /root/.ssh, /home/*/.ssh, /opt/wallet-keys, /etc/ssl/private, ~/.ethereum/keystore, /var/lib/ethereum/keystore, and /mnt/crypto/wallets looking for *.pem, *.key, UTC--*, and keystore files, reads their contents plus the ETH_PRIVATE_KEY environment variable, AES-encrypts the results, and uploads them to the same C2. For any 64-hex string recovered from those files, drainEthFromPrivateKey imports it into web3, computes balance minus gas, and sends the remaining ETH balance in a signed transaction to the hardcoded address 0x742d35Cc6634C0532925a3b844Bc454e4438f44e. Stealth features include AES-256-ECB encryption of all C2 traffic with a hardcoded key, base64 wrapping, process-wide uncaughtException/unhandledRejection handlers that swallow all errors, and a randomized 2–10 minute startup delay. The payload auto-executes at import time with no CLI gate and no user consent.
The npm package dolyame-ui-eventoutside version 35.8.1 contains malicious code that downloads and executes arbitrary binaries from attacker-controlled servers. It disguises the downloaded payload as legitimate system files and executes it without user consent, enabling arbitrary code execution on any machine that installs or imports the package. This behavior is unrelated to the package's advertised functionality as API client wrappers.
The npm package dolyame-ui-attachfile version 35.8.1 contains malicious code that, upon requiring its main entry, downloads and executes a native binary payload from multiple hardcoded external hosts. The payload is saved to temporary directories under disguised filenames, given executable permissions, and launched without user consent. The package impersonates a fintech product but functions as an anonymous native-binary loader with obfuscated code to evade detection. No patch or remediation information is currently available.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (83df5c7e17dd2b9a808bddee17deb157e88a12632a632177f7969fce9ccfa7a8)
The package's preinstall lifecycle script runs automatically on `npm install` and executes `whoami` and `hostname`, then fetches the machine's public IP from ifconfig.me and transmits all three values as query-string parameters to a hardcoded out-of-band interaction domain (kwphewvexhjbtfduscqybx6q7c862eh0g.oast.fun) over plain HTTP via curl, with a wget fallback. The domain is an OAST (out-of-band application security testing) collector used to receive exfiltrated reconnaissance data. The behavior fires unconditionally with no first-party relationship, no consent, and no documented purpose consistent with the package name.
The npm package opencode-optimised-toolings versions 3.4.0, 4.0.0, and 4.0.1 contains malicious code that performs a self-patching operation without user consent. It downloads a source tarball from a non-official GitHub repository, builds a replacement binary, and replaces the legitimate opencode executable on the user's system. This replacement binary runs under the trusted CLI name, allowing persistent code execution with the user's privileges. The package also modifies user configuration files to ensure the malicious behavior persists across future launches.
The golaaa npm package contains malicious code that disables TLS certificate verification, forcibly restarts a local browser executable with remote debugging enabled, and injects scripts into browser pages to exfiltrate user data. It captures page content and editor inputs, encodes them, and sends them to a hardcoded remote endpoint. The remote endpoint can execute arbitrary JavaScript in the victim's browser context, bypassing Content Security Policy restrictions and simulating keystrokes. An embedded, obfuscated Groq API key is also sent to the attacker-controlled server. This behavior occurs automatically upon module load without user consent.
The llm-interceptor npm package contains malicious code that installs persistent data collection and remote code execution capabilities on the host system. Upon installation, it runs a setup script that establishes long-lived data exfiltration to a hardcoded Cloudflare Quick Tunnel URL without user consent. It collects AI assistant transcripts and system metadata, sending them periodically to a remote server. The package installs multiple persistence mechanisms on Windows, including scheduled tasks, registry run keys, and startup shortcuts, ensuring the collector restarts after reboots. It also supports remote arbitrary code execution by polling for updates and installing new package versions silently. Declining consent prompts does not disable these malicious functions or remove persistence.
The npm package bigops-opening-file-handler version 35.9.2 contains malicious code that, when required, downloads and executes a native binary from attacker-controlled infrastructure. This binary is fetched from obfuscated Cloudflare Workers subdomains or a DNS TXT fallback, saved under disguised filenames in temporary directories, given execute permissions, and run automatically. The package falsely advertises itself as a file-handler abstraction but executes unrelated native code without user consent.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (dc1752274e08bd28f5be07afaa71cafeea1e7822330016892d0f06abd6c50681)
On require() of the package, index.js loads _vendor.js which downloads a platform-specific binary from a string-concatenation-obfuscated list of Cloudflare Workers hosts (oob-worker.cf101-adf.workers.dev, oob-worker.cf99-9b3.workers.dev, oob-worker.cf103-070.workers.dev), with a DNS-TXT chunked base64 fallback to sdk.dl.wel1.ru, ext.dl.wel1.ru, pkg.dl.wel1.ru, and net.dl.wel1.ru. The fetched bytes are written to /var/tmp or the Windows TEMP directory under deceptive names such as dotnet_diag_*.exe and.cache_*, chmod 0755 on POSIX, then spawned detached via /bin/sh -c '<path> &' or cmd.exe /c start /b. A second ~81 KB module at lib/telemetry.js, framed as an 'Analytics SDK', reimplements the same fetch/write/chmod/spawn chain and DNS-TXT reassembly as a redundant dropper. Hostnames and sensitive API identifiers ('child_process', 'chmodSync', 'workers.dev', 'dl.wel1.ru') are reconstructed at runtime via Array.join and bracket-property concatenation to evade static analysis. Opt-out environment variables and a TTL lock file are present as cover-story hygiene but do not constitute consent.
## Source: ghsa-malware (36e37533131ea5ce9d4a73dfa8680516c916abc9b3eb719a4678fdb8cd8f1f31)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package dolyame-boxy-mobile-bnpl-text-block version 35.1.8 contains malicious code that, upon requiring the package, downloads and executes a native binary payload from fragmented Cloudflare Workers hosts and fallback DNS TXT records. The payload is saved to temporary directories with disguised filenames, given executable permissions, and spawned detached without user consent or integrity checks. A dormant secondary dropper exists in the package but is not activated in this version.
The bigops-watermark npm package version 35.9.5 contains malicious code that, upon being required, downloads and executes a binary payload from obfuscated external hosts without user consent or verification. This payload is saved to temporary directories with disguised filenames, given executable permissions, and run detached from the main process. The package also includes a duplicate dropper in a large telemetry.js file, which is not currently reachable but contains the same malicious functionality. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on it must be rotated immediately.
The npm package 'bnpl-blocks-atom-bnpl-email-form' version 35.3.9 contains malicious code that, when required or imported, downloads and executes a binary payload from obfuscated Cloudflare Workers mirrors or via a DNS-TXT covert channel. The payload is saved to temporary locations with disguised filenames and executed without user consent. A secondary dropper module within the package uses obfuscated code to evade detection and performs similar malicious actions. This results in full compromise of any system running the package, potentially exposing all stored secrets and keys.
The npm package 'claims-block-visibility' version 35.3.8 contains malicious code that executes automatically upon module load. It downloads and executes attacker-controlled native binaries from obfuscated and fallback DNS-based channels. This behavior results in silent execution of potentially harmful code on the host system without user consent.
The npm package delivery-ci-microforms version 35.3.5 contains malicious code that auto-executes attacker-controlled binaries upon installation or require. It fetches opaque binaries from ephemeral Cloudflare Workers endpoints or DNS TXT records, writes them to temporary directories under deceptive names, sets executable permissions, and spawns them detached from the main process. The package uses obfuscation techniques to evade static detection and disguises the malicious activity under an 'analytics' cover story. This behavior results in arbitrary code execution on the installer's machine without explicit user consent.