The jito-bundle-solana npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'jito-bundle-jito-tip7' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, secure computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by its installation.
The npm package @touchkey0111/jito-bundle contains malicious code that compromises any computer on which it is installed or running. Installation of this package can lead to full system compromise, including unauthorized access to secrets and keys stored on the affected machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by it, and immediate rotation of all secrets and keys from a different, uncompromised computer is strongly advised.
The jito-bundle-jitotip npm package contains malicious code that can fully compromise any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, full remediation may require rotating all secrets and keys from a separate, uncompromised device.
The npm package 'arbkit' contains malicious code that fully compromises any computer on which it is installed or running. This compromise includes potential unauthorized access to all secrets and keys stored on the affected system. Immediate removal of the package is recommended, but due to the extent of the compromise, complete remediation cannot be guaranteed by removal alone.
The PyPI package 'ln9qw38745g' versions 0.1.0 and 0.1.1 contain embedded malicious code. This package overrides the installation process to execute malware, specifically a remote access trojan (RAT), during setup. It is linked to a prior package that switched from benign to malicious executables after a few releases.
The PyPI package 'protecteda' version 0.1.0 contains embedded malicious code that acts as an infostealer when executed as a module. This malware is part of a campaign identified as 2026-11-protecteda with clear malicious intent to steal information.
The npm package 'txnforge' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee full remediation, as the attacker may have established persistent control over the system.
The npm package 'print-hello-world-test-temp' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a separate, uncompromised device. Removing the package alone does not guarantee removal of all malicious software introduced by it.
The zyto package on PyPI versions 0.2.0 through 0.2.3 contains malicious code that executes during installation by overriding the install command in setup.py. This behavior is intended to prepare for embedding a Remote Access Trojan (RAT), indicating clear malicious intent. The package has been flagged by some antivirus vendors as malicious and is part of a broader campaign identified as 2026-11-filipt.
The hijuko-pilara package on PyPI is identified as malicious software that uses fake HTTP-downloaded dependencies to track downloads. It serves no legitimate purpose beyond this tracking activity and is associated with dependency confusion tactics. The package is considered low-harm and likely related to pentesting or research activities.
The filipt package on PyPI contains malicious code that executes during installation by overriding the install command in setup.py. This behavior has been identified as malware, specifically a remote access trojan (RAT), by multiple security vendors. The affected versions are 0.1.0 through 0.1.5. There is no CVSS score available for this threat.
The gvmabc package on npm contains malicious code that compromises any computer on which it is installed or running. Full system compromise is likely, and all secrets and keys on the affected system should be rotated immediately from a separate, trusted device. Removing the package alone may not eliminate all malicious components due to potential persistent control by an attacker.
The y0syoh package on npm contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be considered exposed and require immediate rotation from a secure, separate machine. Removal of the package alone may not fully eliminate the malicious presence due to potential additional malware installed by the package.
The npm package 'wolce9' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removing the package alone does not guarantee removal of all malicious components or backdoors introduced by the package.
The npm package 'v36sl2' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted computer. Removal of the package alone does not guarantee elimination of all malicious software introduced by it.
The npm package 'sgj0kx' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone may not eliminate all malicious software introduced by it, as the attacker may have gained full control of the system.
The s775oe npm package contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected computer should be rotated immediately from a different, secure device. Removing the package alone does not guarantee full remediation as the attacker may have established persistent control over the system.
The npm package 'ru0z83' is identified as malicious software. Any system with this package installed or running is considered fully compromised. It is recommended to remove the package and immediately rotate all secrets and keys from a different, uncompromised system. However, removal of the package alone may not eliminate all malicious components due to potential full control granted to an attacker.
The npm package 'rtvu6h' contains malicious code that compromises any computer on which it is installed or running. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, trusted machine. Removal of the package alone does not guarantee elimination of all malicious software or control established by the attacker.