Threats Tagged 'malicious-package'

The kotanku package on PyPI version 0.1.0 contains malicious code that exfiltrates cryptocurrency wallet files during import. This behavior is part of a campaign identified as 2026-08-kotanku, which uses a Telegram bot for exfiltration. No official patch or remediation guidance is provided. There is no evidence of active exploitation in the wild at this time.

The npm package @ornikar/intl-config versions 10.0.2 through 10.0.10 were compromised as part of a large-scale npm supply-chain worm campaign in August 2026. The malicious versions include a preinstall hook that downloads and executes an obfuscated Bun runtime payload which steals a wide range of credentials and secrets from the infected environment. This payload propagates by republishing other packages accessible via stolen npm tokens, causing widespread contamination. Any environment that installed these versions with install scripts enabled should be considered fully compromised, requiring immediate credential rotation and removal of the package.

The npm package @ornikar/react-native-svg-transformer versions 1.0.6 through 1.0.13 were compromised as part of a large-scale npm supply-chain worm campaign in August 2026. The malicious versions include a preinstall script that downloads and executes an obfuscated payload designed to steal credentials and secrets from the host environment. This payload harvests various cloud and CI/CD credentials and uses stolen npm tokens to propagate further malicious package republishing. Any environment that installed these versions with install scripts enabled should be considered fully compromised and requires immediate credential rotation.

The npm package 'bnpl-blocks-desktop-bnpl-anchor-title' version 35.2.5 contains malicious code that downloads and executes a platform-specific binary from attacker-controlled infrastructure. This binary is fetched without verification, written to a temporary location, made executable, and executed detached from the main process. The package uses obfuscation techniques to evade detection and includes telemetry components as a cover. Any system with this package installed should be considered fully compromised, and all secrets on that system should be rotated immediately.

The npm package 'streak-map-cache' version 1.0.0 contains malicious code that executes a bundled Linux ELF binary acting as a RedShell command-and-control implant. This binary runs on every import, communicates with a hardcoded C2 server over HTTP, and supports remote shell commands, proxying, file exfiltration, credential harvesting, and persistence. The malicious binary is disguised as a 'native math accelerator' to evade detection. Any system with this package installed should be considered fully compromised.

The npm package '@ssgw/icon' version 9.999.999 has been identified as malicious by the OpenSSF Package Analysis project. The package is flagged because it communicates with a domain associated with malicious activity. There is no information about a patch or remediation. No active exploits in the wild have been reported. The package is not a cloud service, and no CVSS score is available.

The pytablute package version 1.0.3 on PyPI contains malicious code that executes upon import or use. This code downloads a secondary malicious script and runs a background process that periodically connects to a remote host to receive and execute further commands. The package is obfuscated and designed to execute remote commands on the victim's machine, indicating clear malicious intent.

The chaintest package on PyPI version 0.1.0 contains malicious code functioning as a cryptocurrency infostealer. It exfiltrates sensitive data from browsers, including cryptowallet extensions and local storage, as well as standalone applications like password managers and cryptowallets. The malware achieves persistence on different platforms, runs a keylogger that alters copied cryptocurrency addresses to attacker-controlled ones, and can execute remote commands from a command-and-control server. It also exfiltrates SSH keys, installs malicious browser extensions, and shares similarities with a known DPRK-linked campaign.

The npm package 'tokocrytodev' version 1.0.0 contains malicious code that, upon execution, establishes a command-and-control (C2) communication channel to a remote server. It executes arbitrary commands received from the attacker, harvests private key files from various sensitive directories, and exfiltrates them encrypted. The package then uses stolen Ethereum private keys to transfer funds from compromised wallets to a hardcoded attacker address. Errors are silently suppressed to avoid detection.

The npm package simple-date-formatter-new-10 version 1.0.0 contains malicious code that executes during installation. It opens a reverse shell to a remote attacker and exfiltrates SSH keys and user information to a command and control server. The advertised date-formatting functionality is a cover for these attack payloads.