# Threat Watch by Helix — Supply chain

> Live security incidents: actively exploited vulnerabilities, breaches and supply-chain attacks — patch status, fixed versions and what to do, curated by Helix Cyber.

All endpoints are public JSON/XML/text with CORS enabled; no auth. Poll changes.json at most hourly with If-None-Match (every response carries an ETag).

## Categories

Every incident has exactly one `category`.
- Vulnerabilities (`patch`): 1924 incidents, 52 live. Flaws in software you may run — which versions are affected, the fixed release, and what to do first. Page https://helix.ml/threat-watch?c=patch · RSS https://helix.ml/threat-watch/c/patch/feed.xml · JSON Feed https://helix.ml/threat-watch/c/patch/feed.json · changes https://helix.ml/threat-watch/c/patch/changes.json · llms.txt https://helix.ml/threat-watch/c/patch/llms.txt
- Breaches (`breach`): 1203 incidents, 130 live. Attacks on companies and services. Nothing to patch on your side; rotate credentials and watch for follow-on phishing if you are a customer. Page https://helix.ml/threat-watch?c=breach · RSS https://helix.ml/threat-watch/c/breach/feed.xml · JSON Feed https://helix.ml/threat-watch/c/breach/feed.json · changes https://helix.ml/threat-watch/c/breach/changes.json · llms.txt https://helix.ml/threat-watch/c/breach/llms.txt
- Supply chain (`supply-chain`): 517 incidents, 337 live. Compromised packages, releases, build pipelines and certificates. Check what you depend on and what you trust. Page https://helix.ml/threat-watch?c=supply-chain · RSS https://helix.ml/threat-watch/c/supply-chain/feed.xml · JSON Feed https://helix.ml/threat-watch/c/supply-chain/feed.json · changes https://helix.ml/threat-watch/c/supply-chain/changes.json · llms.txt https://helix.ml/threat-watch/c/supply-chain/llms.txt

## Data

- All incidents: https://helix.ml/threat-watch/incidents.json
- One incident: https://helix.ml/threat-watch/i/<slug>.json (timeline, sources, `agentBrief` markdown)
- Update stream: https://helix.ml/threat-watch/changes.json
- Fields: severity (critical|high|medium|low|unknown), patchStatus (patched|partial|unpatched|no-fix-needed|unknown), status (live|closed), exploited, stacks, tags, cveIds, affectedVersions, fixedVersions, actions.
- Incidents marked `auto: true` were generated from an authoritative catalog (CISA KEV, Have I Been Pwned) and not yet reviewed by an editor.

## Use with your AI

Poll changes.json hourly with ETag; for each new change, fetch the incident JSON, compare `stacks`, `product`, `affectedVersions` and `cveIds` against the systems and dependencies you manage, and alert only when one matches. Follow `actions`.

## Live incidents (337)

### [critical] @theholocron/holocron-plugin-discord — npm package flagged as malware, full host compromise (no CVE)
https://helix.ml/threat-watch/i/theholocron-holocron-plugin-discord-npm-package-flagged-as-malware-full-host-compromise-no-cve · Supply chain · no-fix-needed · since 2026-11-15
GitHub's advisory database published a malware advisory (GHSA-95pv-hv63-58m8) for the npm package @theholocron/holocron-plugin-discord, affecting version 5.0.0-alpha.436. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched versions exist and no known source code is available, indicating the package itself is malicious rather than a compromised dependency. The package reportedly sees ~41K downloads per month, so any environment that installed the affected version is at risk. Removal of the package alone is not guaranteed to eliminate all malicious software. Organisations should treat this as a credential-theft and host-compromise incident and rotate all secrets from a clean machine.
Do: Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a different clean computer; Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the host; Audit dependency lockfiles and CI/CD environments for the affected version 5.0.0-alpha.436 and block the package; Review access logs and monitor for suspicious activity on affected hosts; Check npm audit / GitHub advisory feeds for other packages from the same maintainer

### [critical] gatepay-sdk-python (PyPI): malicious package exfiltrates host info on install/import (no CVE)
https://helix.ml/threat-watch/i/gatepay-sdk-python-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-11-15
GitHub published advisory GHSA-rp2f-46j6-grv4 on 2026-11-15 flagging the PyPI package gatepay-sdk-python as malware. Version 99.99.1 overrides the install command in setup.py to execute malicious code during installation, and importing the module exfiltrates basic host information such as IP address and username; the package has no legitimate purpose. Classified under the GENERIC-standard-pypi-install-pentest campaign as PROBABLY_PENTEST with limited risk, but rated critical with no patched versions — the only remediation is removal. Credit to OpenSSF malicious-packages and kam193's bad-packages database. Any environment that installed or imported the package is affected.
Do: Search environments and dependency lockfiles for gatepay-sdk-python and remove/uninstall it immediately; Treat any host where it was installed or imported as potentially compromised; rotate credentials and review for exfiltrated data (IP, username); Block the package name in internal PyPI mirrors and CI dependency resolution; Review pip install logs and setup.py execution history for signs of the malicious install hook

### [critical] node-zserial npm package 1.0.42 is malware — full machine compromise, no patched version
https://helix.ml/threat-watch/i/node-zserial-npm-package-1-0-42-is-malware-full-machine-compromise-no-patched-version · Supply chain · no-fix-needed · since 2026-11-15
GitHub's advisory database published GHSA-2p2h-g9qq-v2wx on 2026-11-15 flagging version 1.0.42 of the npm package node-zserial as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and no patched versions exist. The package sees roughly 249 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software it installed. Anyone who installed node-zserial 1.0.42 should treat all secrets and keys on affected machines as stolen and rotate them from a clean machine.
Do: Treat any machine with node-zserial 1.0.42 installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and rebuild/reimage affected systems; do not assume removal fully cleans the machine; Audit dependency lockfiles and CI pipelines for node-zserial and block/reject the package; Review logs and network traffic for signs of attacker access following installation

### [critical] GENERIC-questionable-pentest typosquat campaign: gateio-ws / gateio-sdk / gateio-client / gateio-v4 (PyPI) exfiltrate env vars and host data on install
https://helix.ml/threat-watch/i/generic-questionable-pentest-typosquat-campaign-gateio-ws-gateio-sdk-gateio-client-pypi-packages-exfiltrate-env-vars-and · Supply chain · no-fix-needed · since 2026-11-14
OpenSSF's malicious-packages database and the GitHub Advisory Database flagged four PyPI packages — gateio-ws, gateio-sdk, gateio-client and gateio-v4 — as malicious typosquats of legitimate Gate.io-related libraries. Versions 99.99.1 and 99.99.2 (gateio-client and gateio-v4 only 99.99.1) override the install command in setup.py to execute code during pip install, and gateio-v4 also exfiltrates host information (IP, username) on module import. The packages exfiltrate environment variables and basic host data, and have no legitimate purpose. They are attributed to a 'GENERIC-questionable-pentest' / 'GENERIC-standard-pypi-install-pentest' campaign — likely research or pentest tooling whose data collection raises privacy and security concerns — and are classified as malicious (CWE-506). No patched versions exist; the packages remain on PyPI and anyone who installed or imported them is affected.
Do: Search dependency caches, lockfiles and CI logs for gateio-ws, gateio-sdk, gateio-client or gateio-v4 and remove any installation; Treat any host where these packages were installed or imported as compromised: rotate all secrets present in environment variables (API keys, tokens, credentials); Review pip install logs and CI/CD pipelines for execution of these packages, especially builds using 'pip install' of unvetted dependencies; Block these package names in internal PyPI mirrors/proxies and enforce allowlists or hash-pinning for installs; Audit for other typosquats of crypto-exchange SDK names in your dependency tree

### [critical] @crvouga/mockingbird-service-microsoft npm package contains malware (no CVE)
https://helix.ml/threat-watch/i/crvouga-mockingbird-service-microsoft-npm-package-contains-malware-no-cve · Supply chain · no-fix-needed · since 2026-11-15
GitHub published advisory GHSA-w3gq-mm9x-7w7c on 2026-11-15 flagging version 0.14.0 of the npm package @crvouga/mockingbird-service-microsoft as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with attacker control implying potential theft of secrets, keys, and credentials. The package has roughly 2,839 monthly downloads and 4 GitHub stars, so exposure is limited but real. No patched version exists and no source code is available; the advisory recommends removal, but removal alone cannot guarantee the machine is clean since full control may have been handed to an outside entity. Affected users must treat the host as compromised, rotate all secrets from a separate machine, and rebuild the environment.
Do: Stop using and uninstall @crvouga/mockingbird-service-microsoft 0.14.0 immediately; Treat all machines that ran the package as fully compromised; rotate all secrets and keys from a clean computer; Rebuild/reimage affected hosts and audit for persistence and attacker access; Review CI/CD and developer machines that installed the package for credential exposure; Block the package in dependency policies and check lockfiles for the dependency

### [critical] testpackage83 (npm): malicious package downloads and executes remote binary via postinstall and on import
https://helix.ml/threat-watch/i/testpackage83-npm-malicious-package-downloads-and-executes-remote-binary-via-postinstall-and-on-import · Supply chain · no-fix-needed · since 2026-11-14
The npm package testpackage83@1.0.0 is confirmed malware (CWE-506). Its postinstall script downloads an executable from http://185.212.128.180/chromedriver.bat, writes it to ~/.celest/bin/chrome (or chrome.exe), marks it executable, and launches it via puppeteer-core. The download-and-execute path is also triggered from src/browser.js on first require()/import, bypassing the CELEST_SKIP_DOWNLOAD opt-out. The artifact is fetched over plain HTTP from a bare IPv4 address with no hash, signature, or version pinning, so the host operator fully controls the executed code. Anyone installing or importing the package runs attacker-controlled code. No patched version exists; the package should be removed.
Do: Remove and uninstall testpackage83 immediately; purge ~/.celest/bin and any downloaded chrome/chrome.exe artifacts; Audit machines that installed the package for compromise and rotate credentials/secrets accessible to those environments; Block 185.212.128.180 at network egress and check proxy/DNS logs for connections to it; Check lockfiles and CI caches for testpackage83@1.0.0 and rebuild from clean environments; Pin dependencies and enable npm provenance/audit tooling to detect similar download-and-execute postinstall packages

### [critical] demo-pingtest-xyz (PyPI): malicious package exfiltrates host info on install/import (no CVE)
https://helix.ml/threat-watch/i/demo-pingtest-xyz-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-11-14
GitHub's advisory database (crediting OpenSSF's malicious-packages project and kam193's bad-packages database) flagged the PyPI package demo-pingtest-xyz as malware. Version 0.0.1 overrides the install command in setup.py so malicious code runs during pip install, and importing the module also triggers exfiltration of basic host information such as IP address and username; the package has no legitimate purpose. It is categorised as PROBABLY_PENTEST with limited risk, but the advisory rates it critical. No patched versions exist — the package is malware and should simply be removed. Anyone who installed it or imported the module should treat host data as potentially exposed.
Do: Search environments for demo-pingtest-xyz and uninstall it; block the package name in internal PyPI mirrors/proxies; If installed or imported, investigate what host data (IP, username) may have been exfiltrated and review outbound connections from affected machines; Rotate credentials used on affected hosts if exfiltration is confirmed or suspected; Audit pip install logs and CI pipelines for use of the package; Enforce dependency allowlists/scanning (e.g. OSV/GHSA checks) for Python dependencies

### [critical] ps-bool PyPI malware: obfuscated code exfiltrates photos/documents to Telegram bot, targets Android
https://helix.ml/threat-watch/i/ps-bool-pypi-malware-obfuscated-code-exfiltrates-photos-documents-to-telegram-bot-targets-android · Supply chain · no-fix-needed · since 2026-11-14
The PyPI package ps-bool was found to contain malicious code: on import, obfuscated code exfiltrates photos and documents to an attacker-controlled Telegram bot, with targeting of Android devices. Versions 0.2.0, 0.2.1, 0.2.3, 0.2.4 and 0.2.5 are affected, with no clean version available. The advisory was published to the GitHub Advisory Database on 2026-11-14, credited to researcher kam193 via OpenSSF's malicious-packages database. Anyone who installed or imported ps-bool, particularly on Android environments, should assume file exfiltration occurred. There is no fix; the package should be treated as malware and removed entirely.
Do: Remove ps-bool from all environments and dependency manifests immediately; do not upgrade within the package; Audit systems where it was installed for exfiltrated photos/documents and review Telegram bot traffic and egress logs; Rotate any credentials or sensitive data accessible from affected devices, especially Android devices; Check lockfiles and CI caches for residual copies and block the package name in your registry proxy

### [critical] Malicious PyPI package xrfdc exfiltrates host info on install/import (no CVE)
https://helix.ml/threat-watch/i/malicious-pypi-package-xrfdc-exfiltrates-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-11-14
GitHub Advisory Database published GHSA-fmq9-qj28-89vh on 2026-11-14 flagging the PyPI package xrfdc as malicious. Installing the package or importing the module exfiltrates basic host information (e.g., IP address, username), and the package has no legitimate purpose. The malicious code runs during installation because setup.py overrides the install command, so even a pip install without importing is enough to trigger exfiltration. Affected versions are 0.0.0 and 2.0, with no patched versions available. The advisory categorises it as PROBABLY_PENTEST with limited risk, credited to OpenSSF's malicious-packages database and kam193's bad-packages research. Any developer or CI environment that installed xrfdc from PyPI is affected.
Do: Remove xrfdc from all environments and dependency files; do not install any version; Audit build logs and hosts where xrfdc was installed or imported for signs of data exfiltration (outbound connections, leaked IP/username data); Rotate credentials and secrets that may have been present on affected machines or CI runners; Check dependency lockfiles and SBOMs for historical use of xrfdc; Block the package name in internal PyPI mirrors/proxies

### [medium] trezortranslate (PyPI): malicious package exfiltrates host info on install/import (no CVE)
https://helix.ml/threat-watch/i/trezortranslate-pypi-malicious-package-exfiltrates-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-11-14
GitHub Advisory Database (GHSA-9fc6-4mrc-h6pp, published 2026-11-14) flags the PyPI package trezortranslate as malicious. Versions 0.0.0 and 1.0.0 override the install command in setup.py to execute code during pip install, and installing or importing the module exfiltrates basic host information such as IP address and username; the package has no legitimate purpose. Classified by the source as PROBABLY_PENTEST under the GENERIC-standard-pypi-install-pentest campaign with limited risk. No patched versions exist — the package is malware and should be removed, not upgraded. Anyone who installed it via pip is affected; no in-the-wild exploitation beyond the package's own behavior is reported.
Do: Search environments and dependency lockfiles for trezortranslate and uninstall it if present; Treat hosts where it was installed as potentially exposed: rotate credentials of the affected user, review network egress logs for exfiltration; Block/flag the package name in internal PyPI mirrors and CI dependency scanning; Audit pip install logs and setup.py-driven builds for unexpected network activity

### [critical] @sfunction/dsh-screenshot npm package is malware — full machine compromise for installers (no CVE)
https://helix.ml/threat-watch/i/sfunction-dsh-screenshot-npm-package-is-malware-full-machine-compromise-for-installers-no-cve · Supply chain · no-fix-needed · since 2026-11-14
GitHub's malware advisory database published GHSA-7jf6-qwv2-qppp on 2026-11-14 flagging version 0.1.1 of the npm package @sfunction/dsh-screenshot as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; no patched version exists and no known source code is available. The package sees roughly 749 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove malicious software it may have installed. Affected users must rotate all secrets and keys from a clean machine and rebuild compromised systems.
Do: Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a different clean computer; Remove @sfunction/dsh-screenshot 0.1.1 from all projects and lockfiles; Reimage or rebuild affected machines; do not assume removal cleans up the malware; Audit systems for signs of compromise and unexpected outbound connections; Block the package in internal registries and CI dependency checks

### [critical] Malicious npm package know_your_why_by_ken_costa_46wpa fully compromises installers
https://helix.ml/threat-watch/i/malicious-npm-package-know-your-why-by-ken-costa-46wpa-fully-compromises-installers · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database (GHSA-c378-v8c4-hpch, published 2026-11-13) flags the npm package know_your_why_by_ken_costa_46wpa as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. GitHub states any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal of the package alone does not guarantee removal of the malicious software. The package sees roughly 13 downloads per month, limiting reach, but any installer is exposed to full machine compromise and secret theft. The only remediation is removal plus full incident response on affected machines.
Do: Rotate all secrets and keys stored on any machine where the package was installed, using a clean computer; Remove the package from all projects and lockfiles and block it in dependency policy; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit for signs of compromise and review credentials, tokens and wallets accessible from those machines

### [critical] PyPI malware campaign 2026-11-testing1345: qap793gl4l — setup.py install hook downloads and runs remote RAT script (no CVE)
https://helix.ml/threat-watch/i/pypi-malware-campaign-2026-11-testing1345-qap793gl4l-setup-py-install-hook-downloads-and-runs-remote-rat-script-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub Advisory Database (GHSA-rm58-9wp3-cwmv, published 2026-11-13, credited to OpenSSF/kam193) flags the PyPI package qap793gl4l version 0.1.1 as malicious, part of a campaign tracked as 2026-11-testing1345. The package overrides the install command in setup.py so malicious code executes during pip installation, then downloads and runs a remote script to deploy a RAT. Analysts noted the remote GitHub repository hosting the payload did not yet contain the malicious code at analysis time. Anyone who installed qap793gl4l 0.1.1 is affected; there are no fixed versions — the package is malware and should be removed, not upgraded.
Do: Check environments and lockfiles for qap793gl4l and remove it; version 0.1.1 is the affected release; Treat any machine where it was installed as compromised: isolate, reimage, rotate credentials and secrets; Hunt for signs of RAT activity and outbound connections to the attacker's payload host; Block the package and associated indicators in artifact/proxy controls; audit for other packages from the same campaign

### [critical] axiom-dragon-xyz PyPI malware — install-time infostealer exfiltrates crypto wallet and cloud credential files
https://helix.ml/threat-watch/i/axiom-dragon-xyz-pypi-malware-install-time-infostealer-exfiltrates-crypto-wallet-and-cloud-credential-files · Supply chain · no-fix-needed · since 2026-11-13
The PyPI package axiom-dragon-xyz version 1.0.4 is confirmed malware, published to the GitHub Advisory Database on 2026-11-13 as part of the 2026-11-axiom-dragon-xyz campaign. The package overrides the install command in setup.py so malicious code executes during pip installation. It acts as an infostealer, exfiltrating sensitive files used by cryptocurrency wallets and files storing cloud credentials, with obfuscation used to evade detection. Anyone who installed version 1.0.4 is affected; there are no patched versions and the package should not be used. Detection credited to kam193 via the OpenSSF malicious-packages database.
Do: Check environments and lockfiles for axiom-dragon-xyz (version 1.0.4) and uninstall it immediately if present; Treat any machine where it was installed as compromised: rotate cloud provider credentials, API keys, and all cryptocurrency wallet keys/seeds stored on or accessible from the host; Review access logs and exfiltration indicators on affected hosts; audit for unauthorized cloud resource use or wallet transactions; Block the package in internal PyPI mirrors, artifact repositories, and CI pipelines; Prefer --no-build-isolation awareness: pin dependencies and use hash verification to prevent install-script execution from unknown packages

### [critical] Ebook-download npm malware cluster: dowload_ebok_* packages — malicious npm packages fully compromise installer machines (no CVE)
https://helix.ml/threat-watch/i/ebook-download-npm-malware-cluster-dowload-ebok-packages-malicious-npm-packages-fully-compromise-installers-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub published multiple malware advisories on 2026-11-13 for a growing cluster of npm packages posing as ebook downloads (titles including works by Claire Dederer, Mark Lesky, Alex de Brienne, Dan Abnett, Robert Kirkman, Dedeker Winston, Bianca Bosker, Marina Abramovic, Moruena Estringana, Dan Gookin, Gina Homolka, J. Kenner, Mark Twain, Simon Furman, Norman Vincent Peale, Vi Keeland, Søren Kierkegaard, James Dashner, Felix Lobrecht and others). All versions are flagged as embedded malicious code (CWE-506) with no patched versions; GitHub states any machine with a package installed should be considered fully compromised, with secrets and keys exposed to an outside entity. Downloads are low (~1-39/month per package), limiting reach, but any installation grants attackers full control. Removal of the package does not guarantee removal of the malware. No CVEs; no fix exists — remediation is host compromise response, not upgrading.
Do: Remove the packages and treat affected machines as fully compromised; Rotate all secrets, keys and credentials stored on affected machines from a clean computer; Rebuild/reimage affected systems and audit for persistence; Check CI/CD and developer machines for these package names in lockfiles and dependency trees; Block the package names in npm registries/proxies and monitor for similar ebook-download typosquat packages

### [critical] zread_cli npm malware: malicious CLI and platform binaries fully compromise installed machines
https://helix.ml/threat-watch/i/zread-cli-npm-malware-malicious-cli-and-platform-binaries-fully-compromise-installed-machines · Supply chain · no-fix-needed · since 2026-11-13
GitHub's Advisory Database published four malware advisories on 2026-11-13 for the npm package zread_cli and three @zread/cli platform-specific binaries (darwin-arm64, darwin-x64, linux-arm64). All versions (>= 0) are flagged as embedded malicious code (CWE-506) with no patched versions and no known source code, indicating a likely typosquat or hijacked package rather than a compromised legitimate release. The advisories state any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to stored secrets and keys. Combined downloads are modest (~440/month), limiting reach, but any installation is treated as an active compromise. No fix exists; removal of the package does not guarantee removal of the malicious software.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where zread_cli or any @zread/cli-* binary was installed, using a clean machine; Isolate and rebuild affected machines from trusted images; do not rely on uninstalling the package; Audit npm lockfiles and CI/CD environments for zread_cli or @zread/cli-* and block these packages; Review logs and network traffic for signs of exfiltration or attacker access following installation

### [critical] @jelou/cli-win32-x64 npm package: malicious code compromises any machine where version 4.26.1 is installed (no CVE)
https://helix.ml/threat-watch/i/jelou-cli-win32-x64-npm-package-malicious-code-compromises-any-machine-where-version-4-26-1-is-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub published advisory GHSA-q78g-75cg-hwq6 on 2026-11-13 flagging @jelou/cli-win32-x64 version 4.26.1 on npm as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. The package draws ~5,865 downloads per month, so a meaningful number of Windows developer machines may be affected. There is no patched version and no known source code; the package should be treated as malicious rather than a compromised legitimate project. Remediation requires removing the package, rotating all secrets and keys from a clean machine, and forensic cleanup, since removal alone cannot be guaranteed to eliminate implanted malware.
Do: Treat any machine with @jelou/cli-win32-x64 4.26.1 installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Remove the package and run malware/forensic cleanup; reimage if in doubt; Audit npm lockfiles and CI caches for the package and block it in registry proxies; Review logs for post-compromise activity and credential use

### [critical] rush-mfa npm package is malware — full compromise of any machine where installed
https://helix.ml/threat-watch/i/rush-mfa-npm-package-is-malware-full-compromise-of-any-machine-where-installed · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database has flagged the npm package rush-mfa as embedded malicious code (CWE-506). Every published version (>= 0) is affected and there is no patched version — the package itself is the attack. GitHub warns that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, harvested secrets and keys, and deployed additional persistent malware. The package sees roughly 332 downloads per month, so exposure is limited but real. Removal of the package does not guarantee removal of all malicious software it installed. No fix will be issued; remediation is incident response on affected hosts.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine where rush-mfa was installed, using a clean machine; Audit affected hosts for persistence and additional malware; rebuild/reimage rather than trusting cleanup; Remove rush-mfa from all projects, lockfiles and CI pipelines; check dependency trees for transitive installs; Review logs and network traffic from affected machines for attacker activity; Block/flag rush-mfa in internal registries and dependency scanning

### [critical] Malicious npm package tailwindcss-hook-forms 0.5.2 — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-tailwindcss-hook-forms-0-5-2-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database (GHSA-8j4g-6q77-9w6p, published 2026-11-13) flags the npm package tailwindcss-hook-forms version 0.5.2 as containing embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside actor; secrets and keys on affected systems must be rotated. The package shows ~52 weekly npm downloads despite a claimed 4,563 GitHub stars, and no patched version exists — the package itself is malware and should be removed. Removal alone is not guaranteed to eliminate all malicious software planted during installation.
Do: Immediately remove tailwindcss-hook-forms@0.5.2 from all projects and lockfiles; Rotate all secrets, keys, and credentials stored on machines where the package was installed, from a clean computer; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit npm dependencies and CI caches for the package and block it in dependency firewalls/allowlists; Review logs and network traffic for signs of exfiltration or attacker access

### [critical] Malicious npm packages asavie-ui and @asavie/i18n flagged as malware — full host compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-asavie-ui-and-asavie-i18n-flagged-as-malware-full-host-compromise · Supply chain · no-fix-needed · since 2026-11-13
GitHub's Advisory Database published malware advisories on 2026-11-13 for two npm packages, asavie-ui (GHSA-wwwv-86vw-pg9w) and @asavie/i18n (GHSA-p2m2-v2jm-mxgq), both classified CWE-506 Embedded Malicious Code. Every version (>= 0) is affected and no patched versions exist, so the packages cannot be safely used at all. The advisories state that any computer with these packages installed or running should be considered fully compromised, with control potentially given to an outside entity, and that removing the package does not guarantee removal of all malicious software. @asavie/i18n shows roughly 351 monthly downloads, indicating some real-world exposure. No CVEs are assigned; remediation is removal plus credential rotation and host rebuild.
Do: Remove asavie-ui and @asavie/i18n from all projects, lockfiles and CI images and block them in your registry/proxy; Rotate all secrets, keys, tokens and credentials stored on any machine where the packages were installed, doing so from a clean machine; Rebuild or reimage affected machines; package removal alone may not remove the malware; Audit install logs and dependency trees to determine when and where the packages were pulled in; Monitor for suspicious outbound connections and follow-up compromise indicators on affected hosts

### [critical] testing1345 (PyPI): malicious package installs RAT via setup.py remote script download
https://helix.ml/threat-watch/i/testing1345-pypi-malicious-package-installs-rat-via-setup-py-remote-script-download · Supply chain · no-fix-needed · since 2026-11-13
The PyPI package testing1345 (version 0.1.0) was identified as malware and published to the GitHub Advisory Database on 2026-11-13 (GHSA-w462-j2j5-xmp7). The package overrides the install command in setup.py so that installing it downloads and executes a script from a remote server. The server serves varying payloads, some benign and some containing next-stage installation, with the final payload being a remote access trojan (RAT). Anyone who pip-installed testing1345 0.1.0 may have a RAT running on their machine. There is no patched version; the package is malware and should be removed. Attribution/analysis credited to kam193 and OpenSSF malicious-packages, with sandbox and VirusTotal references available.
Do: Check whether testing1345 (0.1.0) was installed in any environment; if so, isolate and rebuild the host from trusted images; Treat any machine where the package was installed as compromised: rotate credentials, tokens, and SSH keys accessible from it; Audit pip install logs and CI pipelines for the package name and for setup.py executing remote downloads; Block the package and associated indicators in artifact registries and proxy caches; Hunt for RAT-style C2 traffic on potentially affected hosts

### [critical] Malicious npm package hauntview 0.2.9 — full system compromise of installed machines (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-hauntview-0-2-9-full-system-compromise-of-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database flagged the npm package hauntview version 0.2.9 as containing embedded malicious code (CWE-506), published 2026-11-13. Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside actor. All secrets and keys stored on affected machines must be rotated from a clean computer. There are no patched versions — the package itself is malware — and removal does not guarantee elimination of all malicious software it may have installed. Users who installed hauntview 0.2.9 are affected; no fixed version exists, so the only remediation is removal plus full incident response on affected hosts.
Do: Remove hauntview 0.2.9 from all projects and machines; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild or reimage affected systems; scan for persistence and additional malware; Audit npm lockfiles and CI environments for the package and review access logs for signs of compromise

### [critical] Malicious npm package kampodra 0.8.16 — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-kampodra-0-8-16-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database published GHSA-57xg-9jqp-97gm on 2026-11-13 flagging the npm package kampodra version 0.8.16 as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside actor; all secrets and keys on affected systems must be treated as stolen. The advisory lists no patched versions, so the only remediation is removal plus credential rotation from a clean machine, with no guarantee that removal eliminates all malicious software. The package reportedly sees about 2,170 downloads per month, so any project depending on it should audit dependencies and rebuild affected environments.
Do: Remove kampodra 0.8.16 from all projects and lockfiles; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage compromised systems; do not assume removal fully cleans them; Audit dependency trees and CI environments for the package and signs of compromise

### [critical] node-global-key-listener-v9 (npm): malicious package compromises machines that install it
https://helix.ml/threat-watch/i/node-global-key-listener-v9-npm-malicious-package-compromises-machines-that-install-it · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database published GHSA-vh6f-827c-9wqg on 2026-11-13 flagging the npm package node-global-key-listener-v9 as malware. Versions 0.3.1 through 0.3.7 are affected and there are no patched versions; the package has no known source code repository. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package sees roughly 27 downloads per month, limiting reach, but any installation is treated as a compromise. Removal of the package is recommended but may not remove all malicious software. No fix exists; remediation is removal plus credential rotation from a clean machine.
Do: Treat any machine with node-global-key-listener-v9 installed as fully compromised; isolate and rebuild it; Rotate all secrets, keys and credentials stored on affected machines from a different, clean computer; Remove the package from all projects and lockfiles and block it in dependency policy; Hunt for persistence and follow-on malicious software left by the package; Audit dependency trees for typosquat-style forks of node-global-key-listener

### [medium] Quantum Systems QBase: reported malware in ground-control update; Bundeswehr fleet grounded, then resumed
https://helix.ml/threat-watch/i/quantum-systems-qbase-malware-in-update-german-bundeswehr-drones-grounded-then-cleared-to-fly · Supply chain · unknown · since 2026-11-13
Quantum Systems, a German drone maker that supplies Ukraine, says it spotted a cyberattack at the end of October 2026 and that the threat was contained with its IT and security teams working with the authorities. Der Spiegel, as relayed by The Register, reports that malware was detected in an update to QBase, the company's ground-control software, and that the update reached servers belonging to the Bundeswehr and other customers without directly infecting the drones. The Bundeswehr reportedly grounded its Quantum Systems fleet as a precaution; the company says it was the only customer to do so and that flights have resumed with no risk to operators. The malware-in-update and customer-reach claims rest on a single anonymous-source report that no government statement or second outlet has confirmed. No malware name, CVE, fixed QBase version, attribution or customer count appears in the sources reviewed. Germany's defence ministry declined to comment.
Do: Organisations running QBase or Quantum Systems drones should verify they are on the latest, verified software update and check update provenance/signatures; Review ground-control server logs for indicators of compromise from updates received around late October 2026; Isolate ground-control infrastructure from drone and mission networks where feasible; Report any anomalies to national CERT/defense authorities given the military context

### [critical] @claudecode/cli npm package is malware — full machine compromise, no safe version exists
https://helix.ml/threat-watch/i/claudecode-cli-npm-package-is-malware-full-machine-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-13
GitHub published a malware advisory (GHSA-vp2q-gp5r-xh5j, CWE-506 Embedded Malicious Code) for the npm package @claudecode/cli, which appears to impersonate Anthropic's Claude Code CLI. All versions (>= 0) are affected and there are no patched versions — the package itself is the malware. Any machine where it was installed or run must be considered fully compromised, with attacker control of secrets, keys, and credentials. The package sees roughly 61 downloads per month, limiting reach, but every installation is assumed exploited. Removal of the package does not guarantee removal of malicious software it may have deployed. No fix exists; the only remediation is removal plus full credential rotation and host rebuild.
Do: Immediately uninstall @claudecode/cli from all machines and treat those hosts as compromised; Rotate all secrets, API keys, tokens, and SSH keys stored on or accessible from affected machines, from a clean computer; Rebuild or reimage affected machines rather than trusting cleanup; Audit npm lockfiles and CI pipelines for the package and block it in dependency firewalls/allowlists; Review logs and network egress for signs of attacker activity since installation

### [critical] npm malware wave: casamare, ansi-sanitize, lineparse — malicious packages fully compromise installed machines
https://helix.ml/threat-watch/i/npm-malware-wave-casamare-ansi-sanitize-lineparse-malicious-packages-fully-compromise-installed-machines · Supply chain · no-fix-needed · since 2026-11-13
On 2026-11-13 GitHub published malware advisories for three npm packages: casamare (GHSA-xqvf-vmv8-fhw5), ansi-sanitize (GHSA-59gv-286x-7347) and lineparse (GHSA-949g-9w76-cwfw). All versions (>= 0) are affected and no patched versions exist; the packages are classified as embedded malicious code (CWE-506) with no known source code. GitHub's guidance states any computer with these packages installed or running should be considered fully compromised, with attacker control potentially persisting after package removal. Any developer, CI runner or end user who installed them is affected; secrets and keys on those machines are presumed stolen. Removal alone is not remediation — credential rotation and system rebuild are required.
Do: Check lockfiles, node_modules and CI caches for casamare, ansi-sanitize and lineparse; treat any hit as a full compromise; Rotate all secrets, tokens, SSH keys and signing keys stored on or accessible from affected machines, from a clean machine; Rebuild/reimage affected hosts and runners rather than just uninstalling the packages; Audit npm install logs and CI history for when the packages were introduced and what credentials were exposed since; Block the package names in internal registries and dependency firewalls

### [critical] @ewms/el-bootstrap npm package is malware — full machine compromise for any version installed
https://helix.ml/threat-watch/i/ewms-el-bootstrap-npm-package-is-malware-full-machine-compromise-for-any-version-installed · Supply chain · no-fix-needed · since 2026-11-13
GitHub's advisory database has flagged the npm package @ewms/el-bootstrap as malware (GHSA-v22r-22vf-5p3c, CWE-506), published 2026-11-13. Every version (>= 0) is affected and there are no patched versions — the package itself is the attack. Any computer where it is installed or running should be considered fully compromised, with control potentially handed to an outside entity. All developers, CI systems, and build machines that pulled the package are in scope. Removal of the package does not guarantee removal of the malicious software it may have deployed. No fix exists; remediation is incident response, not upgrading.
Do: Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a clean computer; Remove @ewms/el-bootstrap from all projects, lockfiles, and CI pipelines; Rebuild or forensically clean affected machines; do not assume package removal removes the malware; Audit npm dependency trees and lockfiles for the package and any related suspicious dependencies; Review access logs and monitor for signs of attacker activity on affected hosts

### [critical] hxqrtv-bznwkp-util: malicious npm package fully compromises machines that install it (no CVE)
https://helix.ml/threat-watch/i/hxqrtv-bznwkp-util-malicious-npm-package-fully-compromises-machines-that-install-it-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub published a malware advisory (GHSA-rm59-wxgp-7g45) for the npm package hxqrtv-bznwkp-util, versions 0.0.0-stage and 1.0.0. The package is classified as embedded malicious code (CWE-506) with no known source code and no patched versions. GitHub states any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. Any developer, CI system, or end user that installed these versions is affected. There is no fix; remediation is removal plus full incident response including secret rotation and system rebuild.
Do: Treat any machine with hxqrtv-bznwkp-util installed as fully compromised; rotate all secrets and keys from a clean computer immediately; Remove the package and rebuild/reimage affected machines rather than trusting cleanup; Audit dependency locks and CI caches for the package and block it in registries/proxies; Review logs and credentials for signs of exfiltration or unauthorized access

### [critical] celest-browser (npm): malicious package compromises any machine where installed; no safe version exists
https://helix.ml/threat-watch/i/celest-browser-npm-malicious-package-compromises-any-machine-where-installed-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database flagged the npm package celest-browser as containing embedded malicious code (CWE-506), published 2026-11-13. All versions (>= 0) are affected and no patched version exists; the package has no known source code repository. GitHub states any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity. The package sees roughly 407 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software it installed. No CVE is assigned; this is a malware takedown-style advisory rather than a code vulnerability.
Do: Rotate all secrets and keys stored on any machine where celest-browser was installed, using a different, clean computer; Remove celest-browser from all projects and lockfiles and block it in dependency policies; Rebuild/reimage affected machines; do not assume uninstall removed the malware; Audit for signs of compromise and review CI/CD and developer machines that may have pulled the package

### [critical] sol-wallet-adapater (npm): malicious package compromises machines and exposes all stored secrets and keys (no CVE)
https://helix.ml/threat-watch/i/sol-wallet-adapater-npm-malicious-package-compromises-machines-and-exposes-all-stored-secrets-and-keys-no-cve · Supply chain · no-fix-needed · since 2026-11-13
The GitHub Advisory Database published GHSA-5c87-58w4-f8xf on 2026-11-13 flagging the npm package sol-wallet-adapater (note the misspelling of 'adapter') as malware, affecting all versions (>= 0) with no patched version available. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially given to an outside entity. All secrets and keys stored on affected machines should be rotated immediately from a different computer. The package appears to be a typosquat-style malicious package with no known source code. Removal of the package does not guarantee removal of all malicious software it may have installed. CWE-506 (Embedded Malicious Code) is cited.
Do: Treat any machine with sol-wallet-adapater installed as fully compromised; Rotate all secrets and keys stored on affected machines immediately, from a clean computer; Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software; Audit dependency trees and lockfiles for the package and block it in CI/CD and registry proxies

### [critical] berg-fonbock (npm): malicious package compromises any machine where it is installed (no CVE)
https://helix.ml/threat-watch/i/berg-fonbock-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database flagged the npm package berg-fonbock as embedded malicious code (CWE-506), published 2026-11-13. All versions (>= 0) are affected and no patched version exists; the package has no known source code repository. Any computer with the package installed or running must be considered fully compromised, with control potentially handed to an outside entity. Secrets and keys stored on affected machines are at risk and removal of the package does not guarantee removal of all malicious software. No CVE is assigned; remediation is removal plus credential rotation from a clean machine.
Do: Remove berg-fonbock from all projects and dependency trees (check lockfiles and transitive dependencies); Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Rebuild or wipe compromised machines; do not assume package removal fully cleans the host; Audit npm install and CI logs for berg-fonbock installs and review for signs of compromise; Block the package in internal registries and dependency scanning policies

### [critical] Malware in tailwindcss-animationkit npm package — full compromise of installed machines
https://helix.ml/threat-watch/i/malware-in-tailwindcss-animationkit-npm-package-full-compromise-of-installed-machines · Supply chain · no-fix-needed · since 2026-11-13
GitHub published a malware advisory (GHSA-2hrf-5wrm-jw55, CWE-506) for the npm package tailwindcss-animationkit. All published versions (>= 0) are considered malicious, with no patched versions available. The advisory states that any computer with the package installed or running should be considered fully compromised, with possible full control handed to an outside entity, and that removing the package does not guarantee removal of resulting malicious software. Any developer or CI environment that installed the package is affected; secrets and keys on those machines are presumed stolen. There is no fix — remediation is removal, machine rebuild, and credential rotation.
Do: Rotate all secrets, keys, and tokens that were stored on or accessible from machines where the package was installed, using a clean computer; Remove tailwindcss-animationkit from all projects and lockfiles and rebuild affected machines from trusted images; Audit install logs, CI caches, and dependency trees for other uses of the package; Review access and network logs for signs of attacker activity following installation; Add the package to blocklists / denylists in dependency scanning and CI

### [critical] karma365-mcp npm package — malicious code in v2.1.0 fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/karma365-mcp-npm-package-malicious-code-in-v2-1-0-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub published a malware advisory (GHSA-72xc-q3v8-7grp) for the npm package karma365-mcp, version 2.1.0, on 2026-11-13. The package contains embedded malicious code (CWE-506); any computer where it is installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines are at risk and should be rotated from a clean computer. There are no patched versions — the package is malware and should be removed, though removal cannot guarantee elimination of all malicious software it installed. No fixed version exists; treat any use of this package as a security incident.
Do: Immediately remove karma365-mcp 2.1.0 from all systems and block it in dependency policies; Rotate all secrets, keys, and credentials stored on affected machines, using a clean computer; Rebuild/reimage affected machines; audit for persistence and follow-on malware; Review CI/CD and developer environments for exposure to the package; Check npm lockfiles and dependency trees for karma365-mcp references

### [critical] internallib_v647 / internallib_v811 (npm): malicious packages install unauthenticated HTTP tarball from internal IP, enabling arbitrary code execution on npm install
https://helix.ml/threat-watch/i/internallib-v647-internallib-v811-npm-malicious-packages-install-unauthenticated-http-tarball-from-internal-ip-enabling · Supply chain · no-fix-needed · since 2026-11-13
Two malicious npm packages, internallib_v647@1.0.3 and internallib_v811@1.0.1, were published to the npm registry and flagged by Amazon Inspector via the OpenSSF malicious-packages database on 2026-11-13. Both declare a dependency, internallib-helper, as a plain-HTTP tarball URL pointing at a bare internal IP (http://10.0.77.5:8000/...), with no version pin, no integrity hash, and no TLS. On npm install, npm fetches and installs whatever bytes that endpoint serves and runs any lifecycle scripts in the tarball, so anyone controlling or able to MITM traffic to 10.0.77.5:8000 controls code executed on the installing host. The shipped package code is a trivial stub; the manifest line itself is the install-time execution vector, and the dependency naming mirrors a dependency-confusion/internal-package lure. No patched versions exist; the packages should be removed.
Do: Search lockfiles and installed node_modules for internallib_v647, internallib_v811, and internallib-helper; remove and rebuild from clean sources if found; Audit package.json manifests for dependencies declared as http:// tarball URLs, especially on private IPs, and block them in CI; Check build and developer hosts that installed these packages for signs of lifecycle-script execution (postinstall payloads, unexpected processes, outbound connections); Enforce npm integrity/lockfile checks, disallow non-registry tarball sources, and require TLS for any internal package mirror; Rotate any credentials/secrets that may have been present on affected build environments

### [critical] Dependency-confusion canary malware: curse-allies-module & helper-agent (npm) beacon to webhook.site and mutate local services on install
https://helix.ml/threat-watch/i/dependency-confusion-canary-malware-curse-allies-module-helper-agent-npm-beacon-to-webhook-site-and-mutate-local-service · Supply chain · no-fix-needed · since 2026-11-13
Two malicious npm packages, curse-allies-module 1.0.0 and helper-agent 1.0.1/1.0.4, were published to the npm registry and flagged as malware by Amazon Inspector via OpenSSF on 2026-11-13. Both run a postinstall script (node probe.cjs) that unconditionally POSTs install markers to a hardcoded webhook.site collector, confirming to the attacker that the package name resolved and executed in the installer's environment — a dependency-confusion reconnaissance canary enabling follow-on targeted attacks. helper-agent additionally scans localhost ports (1337, 80, 3000, 8080, 5000) and, if a matching JSON API record (id ECT-987654) is found, overwrites that service's manifest via PUT, granting the author write access to a local service. No patched versions exist; the packages should be treated as removed malware.
Do: Check dependency trees and lockfiles for curse-allies-module and helper-agent and remove them immediately; Audit CI/CD and developer machines that installed these packages for signs of execution (outbound POSTs to webhook.site/a4bf0f9f-6d96-46e6-80ac-b76a5329f481, localhost port scans); Block the webhook.site collector URL at egress firewalls/proxies; Enforce npm registry allowlists or internal-only resolution to prevent dependency confusion; disable install lifecycle scripts (e.g. --ignore-scripts); Investigate any locally running JSON API on ports 1337/80/3000/8080/5000 for tampered manifests or records with id ECT-987654

### [critical] Dependency-confusion malware wave: @securihackbot/depconf-flow-1792484611, axon-web, math-helpers-extra-utils, quickgreet — npm packages exfiltrate host metadata on install
https://helix.ml/threat-watch/i/dependency-confusion-malware-wave-securihackbot-depconf-flow-1792484611-axon-web-math-helpers-extra-utils-quickgreet-npm · Supply chain · no-fix-needed · since 2026-11-13
Four malicious npm packages published as dependency-confusion squats were flagged on 2026-11-13 via GitHub advisories sourced from Amazon Inspector and OpenSSF. @securihackbot/depconf-flow-1792484611@1.2.1 runs a postinstall script that base64-encodes hostname, user, platform, arch and node version and beacons them over plain HTTP to a hardcoded IP (34.143.131.27:18080), with a DNS-exfil fallback. axon-web@12.0.0 and quickgreet@0.0.2 exfiltrate hostname and username via DNS lookups to attacker-controlled interactsh (oast.fun) listeners on require/install. math-helpers-extra-utils@1.0.0/1.0.1 hijacks Wix thunderbolt registry names and executes id/hostname/uname via child_process, sending results to a webhook.site collector. Any build host or developer machine resolving these public names instead of intended internal packages leaks host metadata; no patched versions exist.
Do: Search npm lockfiles, CI logs and dependency trees for the four package names/versions and remove any occurrence; Audit whether internal package names matching these squats exist; if so, assume build hosts were probed and investigate which hostnames/users leaked; Block egress to 34.143.131.27:18080, oast.fun/interactsh domains and webhook.site from build environments; Enforce npm scoped-registry mappings and private registry allowlists so internal names cannot resolve to public tarballs; Disable or gate install lifecycle scripts (npm config set ignore-scripts true / --ignore-scripts) in CI and developer machines

### [critical] r17d-sec-research-marker (npm): postinstall script exfiltrates host metadata and credential-path inventory to webhook.site
https://helix.ml/threat-watch/i/r17d-sec-research-marker-npm-postinstall-script-exfiltrates-host-metadata-and-credential-path-inventory-to-webhook-site · Supply chain · no-fix-needed · since 2026-11-13
The npm package r17d-sec-research-marker@1.0.0 contains malicious code flagged by Amazon Inspector and catalogued by OpenSSF/GitHub as malware (GHSA-7g8r-g568-m7rv, CWE-506). Its postinstall script (collect.js) performs host reconnaissance on install: runs whoami, OS/kernel info, lists the home directory and cwd, probes for credential/config files (~/.npmrc, ~/.gitconfig, ~/.config/gh, ~/.novus), and enumerates all process.env variable names, then POSTs the collected JSON to a hardcoded anonymous webhook.site endpoint. The data reveals CI provider, cloud credential presence and secret-store usage, enabling follow-on credential targeting. The package self-labels as a 'security research POC collecting metadata only', but the installer did not opt in and the destination is an anonymous third-party collector. No patched version exists; the package should be treated as malware and removed.
Do: Check whether r17d-sec-research-marker@1.0.0 is present in any dependency tree or lockfile and remove it immediately; If installed, treat the build machine's environment and credential files as exposed: rotate npm tokens, GitHub/Git credentials, and any cloud or CI secrets that were present; Review CI and developer machines that ran npm install since the package's publication for the exfiltration behavior and any follow-on access; Block outbound requests to webhook.site/f18b2445-73d1-478a-9d3f-1cb21a407c61 in build environments; Audit npm install pipelines with --ignore-scripts where feasible and monitor for similar metadata-exfiltration postinstall scripts

### [critical] @test-org-aczxvz/test-package (npm): malicious init() exfiltrates HMAC keys and bearer tokens to attacker webhook (no CVE)
https://helix.ml/threat-watch/i/test-org-aczxvz-test-package-npm-malicious-init-exfiltrates-hmac-keys-and-bearer-tokens-to-attacker-webhook-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub Advisory Database (GHSA-92mx-87xp-ppw9, credited to Amazon Inspector via OpenSSF malicious-packages) flags npm package @test-org-aczxvz/test-package version 1.0.0 as malware. Its public init(options) API serializes the entire options object — including the HMAC signing key passed as logging_data, bearer token, region, instance, and entropy fields — and POSTs it to a hardcoded collector URL built from options.rng_server_url plus UUID path f4927958-be83-4bb1-9265-eaf4b9e0417d (overridable via RNG_COLLECTOR_UUID, defaulting to a webhook.site-style bin). The payload is sent both as a JSON body and a base64-encoded ?d= query parameter for redundancy. Any caller invoking init() with real runtime credentials silently leaks them to the attacker before local use. No patched version exists; the package must be removed.
Do: Remove @test-org-aczxvz/test-package@1.0.0 from all dependency trees and lockfiles immediately; Rotate any HMAC signing keys, bearer tokens, and credentials passed to init() on systems where the package ran; Audit logs and network egress for POSTs to webhook.site-style bins or the UUID path f4927958-be83-4bb1-9265-eaf4b9e0417d; Scan build and runtime environments for RNG_COLLECTOR_UUID overrides and similar typosquatted @test-org-* packages; Block egress to webhook.site and similar exfiltration services from CI/CD and build hosts

### [critical] Malicious npm package zxcvb90-utils-helper exfiltrates page DOM to webhook.site collector
https://helix.ml/threat-watch/i/malicious-npm-package-zxcvb90-utils-helper-exfiltrates-page-dom-to-webhook-site-collector · Supply chain · no-fix-needed · since 2026-11-13
The npm package zxcvb90-utils-helper@1.0.1 is confirmed malware (GHSA-2rfv-gw97-96gg, CWE-506). Its main entry index.js, on require/import, sends URL-encoded document.documentElement.outerHTML (truncated to 4000 chars) via fetch to a hardcoded attacker-controlled webhook.site collector, silently exfiltrating secrets, tokens, and user data rendered in the page in browser bundles, jsdom, and Electron environments. The package has no declared purpose and an empty description. package.json also declares a self-dependency on itself with an unpinned pre-release range (^0.0.0-stage), so installs resolve whatever bytes the registry currently serves with no integrity pin. No patched versions exist; the only remediation is removal. Reported by Amazon Inspector via OpenSSF malicious-packages.
Do: Remove zxcvb90-utils-helper from all dependency trees and lockfiles immediately; Audit environments where it was imported (browser bundles, jsdom, Electron) for exfiltrated DOM data; rotate any secrets, tokens, or credentials that may have been rendered in affected pages; Check install logs and lockfiles for the unpinned self-dependency and any unexpected resolutions; Block webhook.site egress in build and runtime environments; Scan for other typosquat-style utility packages with no description or purpose

### [critical] @wanzforme/bails4u (npm): malicious package pins unpinned GitHub-hosted libsignal dependency, enabling arbitrary code execution on install
https://helix.ml/threat-watch/i/wanzforme-bails4u-npm-malicious-package-pins-unpinned-github-hosted-libsignal-dependency-enabling-arbitrary-code-executi · Supply chain · no-fix-needed · since 2026-11-13
GitHub Advisory Database (GHSA-38gh-x97r-9cx2, published 2026-11-13) flags the npm package @wanzforme/bails4u version 1.0.0 as malicious code (CWE-506), sourced from Amazon Inspector analysis. The package's package.json declares a runtime dependency on libsignal from github:wanzchil/libsignal-node with no commit SHA, tag, or integrity hash. npm install therefore resolves whatever the repository's default branch currently contains and executes its lifecycle scripts on the installer's machine; the repo owner can push new commits at any time, so future installs fetch and run unverified bytes, bypassing the npm registry's integrity model. A separate static match in lib/Utils/generics.js (ping/HTTP pattern) is consistent with WhatsApp/Baileys-style utilities and not independently indicative of malice. No patched versions exist; the package is malware and should be removed, not updated.
Do: Remove @wanzforme/bails4u from all projects and lockfiles; do not attempt to upgrade; Audit install logs and CI systems for any installs of the package and investigate machines that ran them for compromise (lifecycle scripts executed); Rotate credentials, tokens, and secrets accessible from affected build/developer environments; Pin all GitHub-referenced dependencies to commit SHAs with integrity verification and reject unpinned git dependencies in policy; Scan environments for indicators tied to wanzchil/libsignal-node and block the repository/dependency

### [critical] @rclaude/darwin-x64 & @rclaude/darwin-arm64 npm packages — malicious code, full machine compromise (no CVE)
https://helix.ml/threat-watch/i/rclaude-darwin-x64-npm-package-malicious-code-full-machine-compromise-no-cve · Supply chain · no-fix-needed · since 2026-11-12
GitHub's advisory database published malware advisories for the npm packages @rclaude/darwin-x64 (version 0.2.1) and @rclaude/darwin-arm64 (version 0.2.0), both flagged as CWE-506 embedded malicious code. Any machine with either package installed or running should be considered fully compromised, with the attacker potentially having full control; removing the package does not guarantee removal of all malicious software. No patched versions exist and no source code repositories are known. All users of the packages are affected; secrets and keys on affected machines must be treated as stolen. Remediation is incident response, not an upgrade: remove the packages, rotate credentials from a clean machine, and rebuild compromised hosts.
Do: Treat any machine with @rclaude/darwin-x64 or @rclaude/darwin-arm64 installed as fully compromised; Rotate all secrets, keys and credentials stored on affected machines, from a clean computer; Remove the packages and rebuild/reimage affected hosts rather than trusting cleanup; Audit npm dependencies and lockfiles for the packages and block them in registries/proxies; Review logs and network activity for signs of attacker access

### [critical] stylelint-standard (npm) — malicious package compromises any machine where it is installed (no CVE)
https://helix.ml/threat-watch/i/stylelint-standard-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database flagged the npm package stylelint-standard as embedded malicious code (CWE-506), published 2026-11-13. All versions (>= 0) are affected and no patched version exists; the package has been removed from legitimate use and no source code is known. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to secrets and keys. Reach appears limited (~372 downloads/month), but any installation is treated as compromised. There is no fix — remediation consists of removing the package and rotating all credentials from a clean machine.
Do: Remove stylelint-standard from all projects and CI immediately; Treat every machine where it was installed or run as fully compromised; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild affected systems and audit for persistence and lateral movement; Check dependency lockfiles and CI caches for the package and block it in registries/proxies

### [critical] Malware in em-owa-walletconnect-sign-client (npm) — full compromise of installed machines; no patched version
https://helix.ml/threat-watch/i/malware-in-em-owa-walletconnect-sign-client-npm-full-compromise-of-installed-machines-no-patched-version · Supply chain · no-fix-needed · since 2026-11-13
GitHub published a malware advisory (GHSA-q36f-8vwc-6vxm) on 2026-11-13 for the npm package em-owa-walletconnect-sign-client, flagging it as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with attacker control of the machine and exposure of all secrets and keys stored on it. The package has low reach (~43 downloads/month) but is a wallet-connect themed package likely targeting crypto credentials. Removal of the package does not guarantee removal of resulting malicious software. No source code repository is known for the package.
Do: Treat any machine with the package installed as fully compromised; rotate all secrets and keys from a clean machine; Remove the package and rebuild/reimage affected systems; Audit dependency trees and lockfiles for the package and block it in registries/proxies; Review logs and credentials for signs of exfiltration, especially crypto wallet keys; Rotate npm tokens and CI credentials if the package was used in build environments

### [critical] Malicious npm package jsconvict compromises installers' machines
https://helix.ml/threat-watch/i/malicious-npm-package-jsconvict-compromises-installers-machines · Supply chain · no-fix-needed · since 2026-11-13
GitHub's advisory database published a malware advisory for the npm package jsconvict (GHSA-3c69-7f9m-gpvp) on 2026-11-13. All versions (>= 0) are classified as embedded malicious code (CWE-506) with no patched version available. Any machine where the package is installed or running must be considered fully compromised, with potential full control handed to an outside entity. The package sees roughly 27 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to eliminate malicious software it may have installed. No CVE is assigned; the advisory is a malware takedown-style entry with no known source code repository.
Do: Rotate all secrets and keys stored on any machine where jsconvict was installed, using a different, clean computer; Remove jsconvict from all projects and lockfiles and block it in dependency policies; Rebuild/reimage affected machines; do not assume uninstall removed the malware; Audit for signs of compromise and credential misuse following key rotation; Scan dependency trees for other suspicious low-download packages

### [critical] Malicious npm package tailwind-lines-clamps compromises installer machines (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-tailwind-lines-clamps-compromises-installer-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub's advisory database published a malware advisory for the npm package tailwind-lines-clamps (GHSA-r79p-hc83-2mjh), flagged as CWE-506 embedded malicious code. All versions (>= 0) are affected and no patched version exists, so any installation of the package is considered malicious. The advisory states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the machine, exposing secrets, keys and credentials. The package sees roughly 286 downloads per month, so exposure is limited but real. There is no fix; remediation consists of removing the package and rotating all secrets from a clean machine, since removal alone cannot guarantee the malware is eradicated.
Do: Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different clean computer; Remove tailwind-lines-clamps from all projects and lockfiles and rebuild affected environments from trusted images; Audit machines for persistence and other malicious software left by the package; consider reimaging compromised hosts; Check CI/CD and developer machines for the package and review logs for suspicious activity since installation; Block the package name in internal registries and dependency scanning

### [critical] Malicious npm package mre-notificacao-react — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-mre-notificacao-react-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database published GHSA-p5wc-vpqp-p35f on 2026-11-13 flagging the npm package mre-notificacao-react as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. Any developer or CI environment that installed the package is affected; secrets and keys stored on those machines are at risk. There is no fix — the only remediation is removal plus full incident response on affected hosts.
Do: Stop using and remove mre-notificacao-react from all projects, lockfiles and CI caches; Treat every machine that installed or ran it as fully compromised; rebuild hosts from clean images; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Review access logs and cloud/CI activity for signs of attacker use of stolen credentials; Audit dependencies for other typosquatted or malicious packages from the same source

### [critical] fetchium PyPI malware: covert Windows loader with MSI dropper and Run-key persistence
https://helix.ml/threat-watch/i/fetchium-pypi-malware-covert-windows-loader-with-msi-dropper-and-run-key-persistence · Supply chain · no-fix-needed · since 2026-11-13
The PyPI package fetchium (versions 1.0.0 and 1.0.1), advertised as web/utility helpers (greet/clamp), ships a covert loader that runs on first import. __init__.py silently invokes _loader.run() in a bare try/except; _loader.py contains ~1.9 MB of base64+zlib-encoded payload chunks plus a Windows dropper that silently installs an MSI masquerading as MicrosoftEdgeUpdate.msi via msiexec/WMI. Embedded config evades sandboxes, VMs, and analysis tools and adds HKCU Run-key persistence (Microsoft\CoreRuntime). Flagged by Amazon Inspector and OpenSSF/kam193 as malicious (CWE-506), with VirusTotal and tria.ge samples. No patched versions exist; the package should be treated as fully malicious.
Do: Immediately remove fetchium from all environments and dependency lockfiles; Hunt on Windows hosts for HKCU\Software\Microsoft\Windows\CurrentVersion\Run subkey Microsoft\CoreRuntime and MicrosoftEdgeUpdate.msi artifacts; Reimage or rebuild any Windows machine where the package was imported; Block the package name and associated hashes in artifact registries and proxies; Audit for signs of follow-on infostealer activity and rotate credentials from affected hosts

### [critical] 2026-10-voice-synthesis-profiles: malicious PyPI loader packages qwen3ttsui, voxcpmttslora, garvisometerui download and execute remote scripts
https://helix.ml/threat-watch/i/2026-10-voice-synthesis-profiles-malicious-pypi-loader-packages-qwen3ttsui-voxcpmttslora-garvisometerui-download-and-exe · Supply chain · no-fix-needed · since 2026-11-13
GitHub Advisory Database, crediting OpenSSF's malicious-packages project and researcher kam193, published malware advisories on 2026-11-13 for three PyPI packages: qwen3ttsui (GHSA-jh3g-jv4f-xccp), voxcpmttslora (GHSA-57cv-8g8v-9vg9) and garvisometerui (GHSA-85xg-c949-ffc6). All are version 0.1.0, severity critical, CWE-506 embedded malicious code, and belong to a coordinated campaign tracked as 2026-10-voice-synthesis-profiles. The packages act as loaders that download and execute a script from an attacker-controlled URL; they do not embed the final payload, but are clearly deceptive staging for malicious code such as infostealers. No patched versions exist; the packages should be treated as malware and removed.
Do: Search environments and dependency lockfiles for qwen3ttsui, voxcpmttslora and garvisometerui and remove them immediately; Audit systems where these packages were installed for signs of executed remote code, credential theft or persistence; Rotate credentials and secrets on affected machines; Block these package names in PyPI mirrors/proxies and internal dependency allowlists; Prefer vetted voice-synthesis/TTS packages and enforce dependency scanning and provenance checks

### [critical] my-mcp-server-driving-license-ocr (PyPI): malicious MCP OCR tool exfiltrates driving-license images to hardcoded bare IP over HTTP (no CVE)
https://helix.ml/threat-watch/i/my-mcp-server-driving-license-ocr-pypi-malicious-mcp-ocr-tool-exfiltrates-driving-license-images-to-hardcoded-bare-ip-ov · Supply chain · no-fix-needed · since 2026-11-13
OpenSSF and Amazon Inspector flagged the PyPI package my-mcp-server-driving-license-ocr (version 0.1.3) as malicious code (CWE-506). The package exposes an MCP tool 'analyze_image' advertised as driving-license OCR. It accepts caller-supplied image URLs or base64 image bytes and POSTs them to a hardcoded endpoint, http://42.193.222.35:8000/ocr_pic, over plaintext HTTP. Although the code reads MY_API_URL from the environment, it unconditionally reassigns API_URL to the hardcoded bare IP, silently discarding any caller-provided configuration so the destination cannot be redirected. The bare-IP destination has no publisher or vendor disclosure, receives personally identifiable driving-license images without TLS, and is unreachable/auditable by users. No patched version exists; the package should be treated as compromised and removed.
Do: Immediately remove and stop using my-mcp-server-driving-license-ocr from all environments and MCP configurations; Treat any driving-license or other document images processed through the tool as exfiltrated; initiate incident response and any applicable PII breach notification obligations; Audit environments and MCP client configs for the package and for connections to 42.193.222.35:8000; block that endpoint at network controls; Rotate or re-secure any credentials or data that may have been exposed alongside processed images; Replace with a vetted OCR solution and review other MCP tools for similar hardcoded exfiltration endpoints

### [critical] Malicious npm packages rampage-unpack, griffing-ui-pkg, griffing-ux-pkg, eigenlayer-sdk — full host compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-rampage-unpack-griffing-ui-pkg-griffing-ux-pkg-eigenlayer-sdk-full-host-compromise · Supply chain · no-fix-needed · since 2026-11-13
On 2026-11-13 GitHub published four malware advisories for npm packages rampage-unpack, griffing-ui-pkg, griffing-ux-pkg and eigenlayer-sdk, all flagged CWE-506 (embedded malicious code) with every version affected and no patched releases. The advisories state any machine with these packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, and recommend rotating all secrets and keys from a separate machine. Download volumes are small (11–414 per month), suggesting limited reach, but eigenlayer-sdk's name mimics the legitimate EigenLayer ecosystem and may be a typosquat. No common name, CVE, or evidence of in-the-wild exploitation is given. Removal of the packages is advised, though removal may not eliminate all malicious software.
Do: Immediately uninstall the four packages and rebuild affected machines from trusted images; Rotate all secrets, API keys, SSH keys, and credentials stored on or accessible from affected machines, using a clean computer; Audit dependency lockfiles and CI caches for these packages and block them in registry proxies/allowlists; Review logs and network traffic for signs of exfiltration or persistence; Prefer the legitimate EigenLayer tooling and verify package provenance before installing

### [critical] Malicious Rust crates basek & hesk on crates.io — keyloggers/wallet stealers exfiltrating via Telegram Bot API
https://helix.ml/threat-watch/i/malicious-rust-crates-basek-hesk-on-crates-io-keyloggers-wallet-stealers-exfiltrating-via-telegram-bot-api · Supply chain · no-fix-needed · since 2026-11-13
Two malicious Rust crates published on crates.io, basek 0.1.0 and hesk 0.1.0, were identified and published to the GitHub Advisory Database on 2026-11-13. basek is a Windows keylogger: its get_data() routine captures keystrokes, batches them with the local username, and exfiltrates via the Telegram Bot API (XOR-obfuscated bot token, hardcoded chat_id 7304091279) plus a secondary endpoint keylogger.nullsect0r.tech; it installs to %LOCALAPPDATA%\WindowsSystemUtility\WinSysUtils.exe, adds an HKCU Run key, spawns a watchdog clone, and self-deletes, with sleep/warmup/jitter anti-sandbox tricks. hesk contains async payloads (dat, bs) that walk the home directory, zip wallet artefacts (e.g. exodus.wallet), and upload them via Telegram, padded with ~100 filler functions for camouflage; its dependencies add keylogging and Windows persistence capability. Both use 'educational project' framing. No fixed versions exist; the crates should be treated as fully malicious.
Do: Immediately check lockfiles and dependency trees for basek or hesk and remove them; treat any build that included them as compromised; If installed on Windows hosts, hunt for %LOCALAPPDATA%\WindowsSystemUtility\WinSysUtils.exe, HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run value 'WinSysUtils', random 12-digit-named watchdog processes, and outbound traffic to api.telegram.org and keylogger.nullsect0r.tech; Assume keystrokes and credentials typed on affected machines were captured; rotate passwords, tokens, and keys, prioritising wallet/exchange credentials; Check for missing or exfiltrated crypto wallet files (e.g. exodus.wallet) and move remaining assets to new wallets/seed phrases; Block network indicators (api.telegram.org bot endpoints used, keylogger.nullsect0r.tech) and review egress logs for prior exfiltration; Rebuild affected systems from clean images rather than attempting in-place cleanup

### [critical] PyPI loader malware campaign: dashloom & acustoviasr — malicious packages download and execute remote code (no CVE)
https://helix.ml/threat-watch/i/pypi-loader-malware-campaign-dashloom-acustoviasr-malicious-packages-download-and-execute-remote-code-no-cve · Supply chain · no-fix-needed · since 2026-11-13
GitHub Advisory Database (via OpenSSF malicious-packages) published malware advisories for two PyPI packages on 2026-11-13. dashloom (versions 1.0.0–1.1.1) is a malicious loader that pins a vulnerable pydash dependency, abusing pydash.invoke(...) to escape object scope and execute code split across a now-benign GitHub file; the same account also published a repository executing embedded encrypted code. acustoviasr (0.1.0) belongs to a coordinated campaign of similar loader packages that execute code fetched from a URL, though no payload or observed usage is known. Both are classified MALICIOUS with infostealer-style intent, no patched versions exist, and the packages should be treated as compromised. Any project depending on them is exposed to arbitrary remote code execution.
Do: Remove and purge dashloom and acustoviasr from all environments, lockfiles, and caches; treat any machine that installed them as compromised; Audit dependency trees and CI caches for the affected packages and versions (dashloom 1.0.0–1.1.1, acustoviasr 0.1.0); Rotate credentials, tokens, and secrets accessible from affected build or dev environments; Review logs and GitHub/PyPI activity for connections fetching remote scripts or unexpected pydash.invoke usage; Prefer pinned, hashed dependencies and block installs of newly published unvetted packages

### [critical] Malicious npm package @i18n.site/cli-win32-x64 0.1.10 — full machine compromise; rotate secrets
https://helix.ml/threat-watch/i/malicious-npm-package-i18n-site-cli-win32-x64-0-1-10-full-machine-compromise-rotate-secrets · Supply chain · no-fix-needed · since 2026-11-13
GitHub's malware advisory database flagged the npm package @i18n.site/cli-win32-x64 version 0.1.10 as containing embedded malicious code (CWE-506). Any machine where the package was installed or executed should be considered fully compromised, with attacker control of the system and access to stored secrets and keys. No patched version exists; the advisory recommends removal of the package and immediate rotation of all secrets and keys from a clean machine, noting removal alone cannot guarantee eradication of the malicious software. Affected users are developers on Windows who installed this platform-specific binary package, likely as a dependency of the i18n.site tooling.
Do: Rotate all secrets, keys, and credentials stored on any machine that installed the package, using a different clean computer; Remove @i18n.site/cli-win32-x64 0.1.10 from all systems and lockfiles; Rebuild/reimage affected machines; do not assume removal fully cleans the system; Audit for signs of compromise and review npm dependency trees for other i18n.site packages

### [critical] GitHub Actions: hijacked accounts push CI secret stealer to ~62k repos (GhostActions-linked)
https://helix.ml/threat-watch/i/ghostactions-linked-ci-secret-stealer-github-compromised-accounts-push-workflow-payload-to-62k-repos-stealing-actions-cl · Supply chain · no-fix-needed · since 2026-11-12
Aikido Security reports that from about 12:45 UTC on 2026-11-10 a threat actor used stolen GitHub credentials to open 'docs: dependency audit notes' probe pull requests from wfx-docs branches across 61,764 repositories held by 4,837 compromised accounts. Where a probe confirmed write access, the actor pushed one of three payloads (an injected workflow, an npm postinstall hook, or a throwaway chore/ branch workflow), then reverted it and deleted the workflow run within a minute. Aikido counts at least 1,806 repositories where the payload ran and credentials were exfiltrated, likely an undercount because run logs were deleted. The stealer collects Actions secrets, GITHUB_TOKEN, OIDC tokens, cloud, AI-provider and developer credentials and runner memory; it then tries to reach AWS, GCP, Azure and Vault, and persists by posting forged branch-protection status checks, widening an AWS role trust policy and adding Azure federated credentials. The same payload appears in the Packagist package digitalelvis/neuronai-studio 3.14.3 and in Go module tags github.com/onuragtas/docker-env v1.0.278 and v1.0.280, where it sits only in a workflow file. Aikido sees account overlap with the October GhostActions wave but does not attribute the two to one actor. Exploited in the wild; no vendor fix exists, and Aikido's advice is to rotate credentials, audit repositories and remove the affected packages.
Do: Search every repository you can write to, public and private, for pull requests titled 'docs: dependency audit notes', branches wfx-docs, chore/ plus eight characters and ci-check-NNNN, and commits 'ci: refresh build cache', 'ci: restore', 'ci: cleanup', 'chore: add ci helper' or 'chore: add dependency audit workflow', dated from 2026-11-10 12:45 UTC; Hunt for the stealer script (SHA-256 89695abb392d5cfd4972672961e644bb46baa98aa1ed7173c2a2816c762735cf), for .github/workflows/build-audit-*.yml, for .ci-*.sh files, and for a postinstall hook in package.json that runs them; Check workflow run numbers for gaps; a missing run number on an attacker commit is the most reliable sign the payload ran, because the run and its logs were deleted; If the payload ran, treat every secret, GITHUB_TOKEN, OIDC trust and cloud role reachable from its workflows as compromised: rotate GitHub Actions secrets, AWS, GCP and Azure credentials, Vault and Kubernetes tokens, and AI-provider keys; In AWS, look for IAM roles whose trust policy Principal is "*" and for new IAM access keys (iam:CreateAccessKey); in Azure, remove federated identity credentials named wfx-ci-...; in GCP, review service account key use and impersonation; Review branch protection for success statuses posted against commit SHAs under your required check names, and block egress to 194.150.166.244:8080 and 18.143.168.96:8080 (/exfil); Remove Packagist digitalelvis/neuronai-studio 3.14.3 and Go module github.com/onuragtas/docker-env v1.0.278, v1.0.280 and v1.0.282 (the Go payload is workflow-only, but remove them anyway; SafeDep lists v1.0.279, v1.0.281 and v1.0.283 as clean attacker reverts), and github.com/vkuznet/gocurl pseudo-version v0.0.0-20261111095532-8d5aad0cb0da (workflow file only); treat any machine that installed or opened the Packagist version as compromised; Revoke tokens and sessions of any account that appears in probe pull requests, and tighten Actions permissions and OIDC subject scoping so workflows cannot reach cloud roles from untrusted branches; Block egress to api.telegram.org from CI runners where it is not needed: from about 2026-11-12 05:30 UTC (StepSecurity first-seen) copies of the stealer exfiltrate via Telegram, which a bare-IP blocklist misses

### [critical] 2026-10-voice-synthesis-profiles: malicious PyPI loader packages (eulaliatts, evalometer, ferrotts, lumitts) download and execute remote scripts
https://helix.ml/threat-watch/i/2026-10-voice-synthesis-profiles-malicious-pypi-loader-packages-eulaliatts-evalometer-ferrotts-lumitts-download-and-exec · Supply chain · no-fix-needed · since 2026-11-12
On 2026-11-12 GitHub published malware advisories for four PyPI packages — eulaliatts, evalometer, ferrotts and lumitts — all at version 0.1.0, attributed to a coordinated campaign dubbed 2026-10-voice-synthesis-profiles. The packages are deceptive loader-style libraries that download and execute code from an attacker-controlled URL. They do not embed the final payload, but they provide a ready mechanism to deliver malicious code (e.g. infostealers) to any developer or CI environment that installs them. No patched versions exist; the packages are classified MALICIOUS (CWE-506) and should be treated as compromised. Anyone who installed any of these packages should consider their build/developer environment potentially compromised.
Do: Search dependency manifests, lockfiles and CI logs for eulaliatts, evalometer, ferrotts or lumitts and remove/uninstall them immediately; If any were installed, rebuild affected machines/containers from trusted images and rotate all credentials, tokens and secrets accessible from those environments; Audit for signs of downloaded/remote code execution and unexpected network fetches during builds; Block these package names in internal proxies/dependency firewalls and pin reviewed dependencies only

### [critical] otto-git-cli (npm): malicious package compromises machines and steals secrets — remove and rotate credentials (no CVE)
https://helix.ml/threat-watch/i/otto-git-cli-npm-malicious-package-compromises-machines-and-steals-secrets-remove-and-rotate-credentials-no-cve · Supply chain · no-fix-needed · since 2026-11-12
GitHub's malware advisory database flagged the npm package otto-git-cli as embedded malicious code (CWE-506), published 2026-11-12. All versions (>= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removal of the package does not guarantee removal of all malicious software. Reach appears limited (~156 downloads/month), but any installer is presumed compromised. Remediation is removal of the package plus rotation of all secrets and keys from a clean machine; no fix will be issued since the package is malware.
Do: Remove otto-git-cli from all machines and CI environments; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage affected machines; do not assume removal cleans the system; Audit for persistence and unauthorized access following compromise; Block the package in npm dependency policies and lockfiles

### [critical] depfix-ai (npm): malicious package compromises machines and steals secrets; no safe version exists
https://helix.ml/threat-watch/i/depfix-ai-npm-malicious-package-compromises-machines-and-steals-secrets-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-12
GitHub's advisory database published GHSA-689j-99g2-vf2f on 2026-11-12 flagging the npm package depfix-ai as malware (CWE-506, Embedded Malicious Code). All versions (>=0) are affected and no patched version exists. GitHub's standard malware guidance states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and removal of the package does not guarantee removal of all malicious software. The package is low-reach (~21 downloads/month, 1 GitHub star) but any installation means credential theft and system compromise should be assumed. No source code repository is known. Affected users must rotate all secrets and keys from a clean machine and rebuild compromised systems.
Do: Rotate all secrets, keys, and credentials stored on machines where depfix-ai was installed, using a different clean computer; Remove depfix-ai from all projects and lockfiles and rebuild/reimage affected machines, as removal may not eliminate the malware; Audit systems for signs of compromise and unexpected persistence or outbound connections; Check dependency trees and CI caches for depfix-ai and block the package name

### [critical] @hesxo/viro-cli and @hesxo/forge-cli npm packages are malware — full machine compromise, no safe versions
https://helix.ml/threat-watch/i/hesxo-viro-cli-and-hesxo-forge-cli-npm-packages-are-malware-full-machine-compromise-no-safe-versions · Supply chain · no-fix-needed · since 2026-11-12
GitHub's advisory database published two malware advisories on 2026-11-12 for npm packages @hesxo/viro-cli (GHSA-g2hr-x6gp-2f6r, ~503 downloads/month) and @hesxo/forge-cli (GHSA-h9jx-jh37-w33x, ~8 downloads/month). Every published version (>= 0) is classified as embedded malicious code (CWE-506) with no patched versions, meaning any installation grants attackers full control of the machine. GitHub's guidance states any computer with the packages installed or running should be considered fully compromised, with secrets and keys exposed to an outside entity; removal of the package does not guarantee removal of all malicious software. There is no safe version; the only remedy is removal plus full credential rotation and system remediation.
Do: Immediately uninstall @hesxo/viro-cli and @hesxo/forge-cli from all machines and CI environments; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, using a clean computer; Rebuild or thoroughly reimage affected systems; removal of the package does not guarantee removal of all malicious software; Audit logs and network traffic for signs of exfiltration or attacker access; Block the packages in npm policies/lockfiles and scan dependency trees for other hesxo packages

### [critical] base65-* npm malware campaign — base65-33x, base65-15x, base65-77x flagged as embedded malicious code; full host compromise
https://helix.ml/threat-watch/i/base65-npm-malware-campaign-base65-33x-base65-15x-base65-77x-flagged-as-embedded-malicious-code-full-host-compromise · Supply chain · no-fix-needed · since 2026-11-12
On 2026-11-12 GitHub published malware advisories for three related npm packages — base65-33x (GHSA-h288-cf23-hrcc), base65-15x (GHSA-v5ww-6933-6prc) and base65-77x (GHSA-v8w4-68hj-hmqq) — all at version 5.0.2, classified as CWE-506 embedded malicious code with no patched versions. The advisories state any computer with these packages installed or running should be considered fully compromised, with attacker control of the machine and no guarantee removal restores a clean state. The near-identical names, versions and publication dates indicate a coordinated typosquat-style malicious package campaign. Downloads are low (~93-97/month), limiting reach, but any installation grants full host compromise. No fix exists; remediation is removal plus credential rotation.
Do: Immediately remove base65-33x, base65-15x and base65-77x from all systems and CI/CD environments; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected machines; do not assume removal of the package removes all malicious software; Audit dependency trees and lockfiles for these or similarly named packages and block them in registries/proxies; Review logs and network traffic for signs of exfiltration or attacker access since installation

### [critical] Malicious npm package @brunosps00/dev-workflow compromises developer machines
https://helix.ml/threat-watch/i/malicious-npm-package-brunosps00-dev-workflow-compromises-developer-machines · Supply chain · no-fix-needed · since 2026-11-12
GitHub's advisory database published a malware advisory for the npm package @brunosps00/dev-workflow, flagging 55 versions (0.0.3 through 2.7.0) as containing embedded malicious code (CWE-506). The package, which sees roughly 590 downloads per month, has no patched versions — every listed release is affected, so removal rather than upgrade is required. The advisory warns that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host, enabling theft of secrets, keys and credentials and persistence beyond simple package removal. No fixed version exists and no source code repository is known. Developers and CI systems that installed any affected version should treat all credentials on those machines as stolen and rotate them immediately.
Do: Immediately stop using and uninstall @brunosps00/dev-workflow from all machines and CI runners; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, using a clean computer; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit logs and networks for signs of attacker access following installation; Scan dependency lockfiles and caches for the package and block it in future installs

### [critical] Malicious RubyGems install-time exfiltration: buffer-code-exercise-api & cheesebox — gems steal system files via fake native extension
https://helix.ml/threat-watch/i/malicious-rubygems-install-time-exfiltration-buffer-code-exercise-api-cheesebox-gems-steal-system-files-via-fake-native · Supply chain · no-fix-needed · since 2026-11-12
Two malicious RubyGems packages, buffer-code-exercise-api 1.0.1 and cheesebox 10.0.1, were identified on 2026-11-12 via GitHub advisories (GHSA-9v6c-5wvv-8xq9, GHSA-9487-f86j-23m4) credited to OpenSSF/amazon-inspector. Both gems abuse the gemspec extensions: entry to run mkrf_conf.rb automatically during gem install. The scripts perform no native build work; instead they collect hostname, username, cwd, home directory and the contents of /etc/passwd, /etc/hosts and /etc/resolv.conf, JSON-encode them, and POST them over TLS to hardcoded Burp Collaborator OAST subdomains (0ef6jllhq32e17z4aaeqzbgn3e9fx5lu.oastify.com and xwx31i3e80kbj4h1s7wnh8yklbrdf33s.oastify.com), preceded by a DNS probe. Any developer or CI system installing these versions leaks host data to attacker infrastructure. No patched versions exist; the gems should be removed and not installed.
Do: Check Gemfile.lock and installed gems for buffer-code-exercise-api 1.0.1 or cheesebox 10.0.1 and remove them immediately; If installed, treat the build host as compromised: rotate credentials available to the install user and review /etc/passwd, /etc/hosts, /etc/resolv.conf exposure impact; Block the oastify.com subdomains at DNS and egress proxies and hunt for prior TLS/DNS connections to them; Audit gemspecs of dependencies for extensions: entries with mkrf_conf.rb that ship no native sources; Prefer pinned, checksum-verified gems and restrict gem install execution in CI

### [critical] future-scripts (npm): package confirmed as malware — full machine compromise, no safe version exists
https://helix.ml/threat-watch/i/future-scripts-npm-package-confirmed-as-malware-full-machine-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-12
GitHub's malware advisory database has flagged the npm package future-scripts as malicious (GHSA-5j4v-g9j4-3f38, CWE-506). Every published version (>= 0) is affected and there are no patched versions, meaning any installation results in full compromise of the host machine and potential handover of control to an outside entity. The advisory instructs that any computer with the package installed or running should be considered fully compromised, with all secrets and keys rotated from a separate machine. The package sees roughly 713 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to eliminate all malicious software it may have deployed. No fix will be issued; the only remediation is removal plus incident response.
Do: Treat any machine with future-scripts installed as fully compromised; rotate all secrets and keys from a clean machine; Remove the package and audit for persistence mechanisms, as removal may not eliminate all malicious software; Check lockfiles and CI pipelines for the dependency and rebuild affected environments from trusted images; Review access logs and credentials accessible from compromised hosts for signs of exfiltration

### [critical] npm typosquat malware wave: ganach, soid-wallet, uniswa-v2-sdk-holesky, cosmjs-types-sovid — full machine compromise; no patched versions
https://helix.ml/threat-watch/i/npm-typosquat-malware-wave-ganach-soid-wallet-uniswa-v2-sdk-holesky-cosmjs-types-sovid-full-machine-compromise-no-patche · Supply chain · no-fix-needed · since 2026-11-12
On 2026-11-12 GitHub published four malware advisories (CWE-506) for npm packages ganach, soid-wallet, uniswa-v2-sdk-holesky and cosmjs-types-sovid, all flagged critical with every version (>=0) affected and no patched versions. The packages appear to be typosquats or clones of legitimate projects (ganache, CosmJS types, Uniswap V2 SDK, wallet tooling) embedding malicious code that grants outside parties full control of installed machines. GitHub's guidance states any computer with the packages installed or running should be considered fully compromised, with secrets and keys at risk; removal of the package does not guarantee removal of the malicious software. Download volumes are low (4–25/month), limiting exposure, but any installation is treated as an active compromise.
Do: Immediately remove ganach, soid-wallet, uniswa-v2-sdk-holesky and cosmjs-types-sovid from all projects, lockfiles and CI caches; Treat every machine where they were installed or run as fully compromised: rotate all secrets, keys, tokens and credentials from a clean machine; Rebuild affected systems from trusted images and audit for persistence; Block the package names in npm policy/firewall and audit dependency trees for similar typosquats

### [critical] Malicious npm packages @budetzz/baileys and @budetzz/libsignal-node flagged as malware
https://helix.ml/threat-watch/i/malicious-npm-packages-budetzz-baileys-and-budetzz-libsignal-node-flagged-as-malware · Supply chain · no-fix-needed · since 2026-11-12
GitHub's advisory database published malware advisories on 2026-11-12 for two npm packages under the @budetzz scope: @budetzz/baileys (GHSA-qpp3-3mx8-62m7, ~2,895 downloads/month, 11K GitHub stars) and @budetzz/libsignal-node (GHSA-6wr3-c2pp-j3r6, ~319 downloads/month). Both are classified CWE-506 Embedded Malicious Code, affect all versions (>= 0), and have no patched versions. GitHub warns that any computer with these packages installed or running should be considered fully compromised, with full control potentially given to an outside entity, and that removing the package may not remove all malicious software. Names mimic the legitimate Baileys WhatsApp library and libsignal, suggesting a typosquat/scope-squat distribution. All secrets and keys on affected machines must be rotated.
Do: Remove @budetzz/baileys and @budetzz/libsignal-node from all projects and lockfiles immediately; Treat affected machines as fully compromised: rebuild/reimage hosts and containers; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Audit for persistence mechanisms and follow-on malware left after package removal; Block the @budetzz npm scope in internal registries and CI, and scan dependency trees for it

### [critical] budetzz npm packages: malware in budetzz and @budetzz/eslint-config compromises any machine that installs them
https://helix.ml/threat-watch/i/budetzz-npm-packages-malware-in-budetzz-and-budetzz-eslint-config-compromises-any-machine-that-installs-them · Supply chain · no-fix-needed · since 2026-11-12
GitHub's advisory database flagged two npm packages, budetzz and @budetzz/eslint-config, as malware on 2026-11-12 (GHSA-xc73-36mq-8442 and GHSA-52pg-f6vh-x249). All published versions (>= 0) are affected and no patched versions exist, so the packages cannot be safely used at any version. The advisories state that any computer with the packages installed or running should be considered fully compromised, implying attacker code execution and potential full machine control, and recommend rotating all secrets and keys from a separate, clean computer. budetzz shows roughly 376 downloads per month; the scoped eslint-config package's download count is not stated. Removal of the packages alone is not guaranteed to eliminate malicious software left behind. No CVE is assigned; the weakness is CWE-506 (embedded malicious code).
Do: Remove budetzz and @budetzz/eslint-config from all projects, lockfiles, and CI caches; treat affected machines as fully compromised; Rotate all secrets, tokens, SSH keys, and credentials stored on or accessible from affected machines, from a clean computer; Rebuild affected machines and audit for persistence mechanisms left by the malware; Audit dependency trees and lockfiles for these packages and block them in registries/proxies; Review CI/CD and developer environments that may have installed the packages for signs of compromise

### [critical] npm malware: @csp-frontend/dashboard and @csp-frontend/auth packages fully compromise installed machines
https://helix.ml/threat-watch/i/npm-malware-csp-frontend-dashboard-and-csp-frontend-auth-packages-fully-compromise-installed-machines · Supply chain · no-fix-needed · since 2026-11-12
GitHub's Advisory Database published malware advisories on 2026-11-12 for two npm packages, @csp-frontend/dashboard (GHSA-4cfc-3234-7449) and @csp-frontend/auth (GHSA-43xc-q6j2-9cw7), both classified as CWE-506 Embedded Malicious Code. All versions (>= 0) are affected and no patched versions exist. The advisories state that any computer with these packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, implying secret and key theft. The packages appear to be typosquat-style or hijacked malicious packages rather than legitimate software; @csp-frontend/auth showed roughly 251 downloads per month. Removal of the package does not guarantee removal of all malicious software it may have installed. Organisations should treat any machine that installed them as breached.
Do: Immediately rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove both packages from all projects, lockfiles and CI caches, and audit for other @csp-frontend/* packages; Rebuild affected machines or containers from trusted images; do not assume removal of the package removes the malware; Review npm install logs, CI pipelines and dependency trees for when and where the packages were pulled in; Block the packages in registry proxies/allowlists and scan for indicators of compromise

### [critical] Malicious npm packages diezyx*-baileys / diezy-libsignal-node — full host compromise via embedded malware (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-packages-diezyx-baileys-diezy-libsignal-node-full-host-compromise-via-embedded-malware-no-cve · Supply chain · no-fix-needed · since 2026-11-12
On 2026-11-12 GitHub published four malware advisories for npm packages diezyxhao-baileys, diezyxalya-baileys, diezyxalisa-baileys and diezy-libsignal-node, all flagged CWE-506 (embedded malicious code) with severity critical. Every version (>= 0) is affected and no patched versions exist. The packages, whose names mimic the popular Baileys WhatsApp library ecosystem, collectively see roughly 3,500 downloads per month. GitHub warns that any machine with these packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. No CVE is assigned; remediation is limited to removal and incident response, as no fix will be published.
Do: Immediately uninstall all four packages from every machine and CI environment and rebuild from clean images; Rotate all secrets, keys, tokens and credentials that were stored on or accessible from affected machines, from a clean computer; Audit install logs and dependency lockfiles to identify when and where the packages were introduced; Inspect affected hosts for persistence mechanisms and residual malware; reimage if compromise is suspected; Block these package names in npm registries/proxies and add them to dependency scanning denylists

### [critical] Malware in stelar-sdk npm package — full host compromise, rotate all secrets
https://helix.ml/threat-watch/i/malware-in-stelar-sdk-npm-package-full-host-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-12
GitHub's advisory database published a malware advisory for the npm package stelar-sdk on 2026-11-12. The package, which has all versions affected (>= 0) and no patched release, contains embedded malicious code (CWE-506). GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host. Any secrets or keys stored on affected machines should be treated as stolen. The package sees roughly 238 downloads per month, so exposure is limited but real. There is no fix; removal of the package does not guarantee removal of any malicious software it may have installed.
Do: Remove stelar-sdk from all projects and machines immediately; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage compromised machines; audit for persistence mechanisms; Audit logs and network traffic for signs of exfiltration or attacker access; Block the package in dependency management and CI

### [critical] Malware in self-certificate npm package — full compromise of installed machines; rotate all secrets
https://helix.ml/threat-watch/i/malware-in-self-certificate-npm-package-full-compromise-of-installed-machines-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-12
GitHub published a malware advisory (GHSA-6p47-hr8r-4wq6) for the npm package self-certificate, classified under CWE-506 Embedded Malicious Code. Every version (>= 0) is affected and no patched version exists; the package has been removed from legitimate use and should be treated as malicious at any version. Any machine with the package installed or running must be considered fully compromised, with control potentially handed to an outside entity. Roughly 151 downloads per month indicate limited but real reach. Removal of the package alone is not guaranteed to eliminate the malicious software it installed. There is no fix; remediation is host-level incident response and credential rotation.
Do: Treat any machine with self-certificate installed as fully compromised; isolate and rebuild from clean images; Rotate all secrets, keys, and credentials stored on affected machines, using a different, clean computer; Remove the package and hunt for persistence or additional malware it may have deployed; Audit dependency trees and CI caches for self-certificate and block its installation

### [critical] Malicious npm package @go-gost/mcp-darwin-x64 — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-go-gost-mcp-darwin-x64-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-12
GitHub's malware advisory database flagged the npm package @go-gost/mcp-darwin-x64 version 0.1.0 as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists; the package has no known source code. Anyone who installed this macOS x64 package — likely developers seeking an MCP server for the GOST proxy tool — is affected. Removal of the package does not guarantee removal of all malicious software. Secrets and keys on affected machines must be treated as stolen.
Do: Remove @go-gost/mcp-darwin-x64 from all systems and CI immediately; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Rebuild or reimage affected machines; scan for persistence mechanisms; Audit npm lockfiles and dependency trees for the package and related @go-gost/mcp packages; Block the package in npm registries and dependency firewall policies

### [critical] Malicious npm package 'solidty' (typo of Solidity) — full machine compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-solidty-typo-of-solidity-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-12
GitHub published advisory GHSA-27m9-96qf-23mq on 2026-11-12 flagging the npm package 'solidty' — a likely typo-squat of 'solidity' — as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and there are no patched versions; the package should not be used at all. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, including access to secrets and keys. The package sees roughly 233 downloads per month. Removal of the package does not guarantee removal of malicious software already deployed. No CVE is assigned; no fix exists beyond removing the package and rebuilding affected systems.
Do: Rotate all secrets, keys, and credentials stored on machines where 'solidty' was installed, using a clean computer; Remove the 'solidty' package and rebuild/reimage affected machines, as removal may not eliminate all malicious software; Audit npm lockfiles and dependency trees for 'solidty' and block it in registries/CI; Check for signs of compromise and investigate persistence mechanisms on affected hosts

### [critical] Malicious npm package npm-builderio-qwik-poc fully compromises installed machines
https://helix.ml/threat-watch/i/malicious-npm-package-npm-builderio-qwik-poc-fully-compromises-installed-machines · Supply chain · no-fix-needed · since 2026-11-12
GitHub published a malware advisory (GHSA-923c-wff6-2p7q) for the npm package npm-builderio-qwik-poc, classified under CWE-506 Embedded Malicious Code. All published versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Anyone who installed the package—directly or as a dependency—should treat secrets and keys on the machine as stolen. Removal of the package does not guarantee removal of all malicious software. The package appears to impersonate Builder.io's Qwik framework. No common name has been assigned to the campaign.
Do: Rotate all secrets, API keys, SSH keys, and credentials stored on any machine where the package was installed, using a clean machine; Rebuild or wipe affected machines rather than just uninstalling the package; Audit dependency trees and lockfiles for npm-builderio-qwik-poc and remove it; Review access logs and monitor for suspicious activity from affected systems; Scan for persistence mechanisms and additional malware left by the package

### [critical] Malicious npm package tailwindcss-hook-forms impersonates @tailwindcss/forms to run obfuscated code on import
https://helix.ml/threat-watch/i/malicious-npm-package-tailwindcss-hook-forms-impersonates-tailwindcss-forms-to-run-obfuscated-code-on-import · Supply chain · no-fix-needed · since 2026-11-11
A malicious npm package, tailwindcss-hook-forms version 0.5.2, impersonates the legitimate @tailwindcss/forms plugin, copying its name, repository, author, README, CHANGELOG and demo links. Its src/index.js contains a hand-rolled string-permutation decoder (spin() with magic constants NX/SX, splitLane/peel wrappers) that resolves the Function constructor and immediately executes a ~15KB obfuscated payload, passing the host require into it. The payload runs whenever any consumer imports the package, giving attacker-controlled code full access to require, process, filesystem and network in the Node.js process, then replicates the public API as cover. Flagged by OpenSSF and Amazon Inspector; no patched versions exist, so removal is the only remediation.
Do: Search lockfiles and node_modules for tailwindcss-hook-forms and remove it immediately; Rotate any credentials, tokens or secrets accessible from affected build/CI environments; Audit build and CI logs and hosts for signs of execution or network egress tied to the package; Pin and verify the legitimate @tailwindcss/forms plugin and review dependency trees for lookalike packages

### [critical] pdf-html5-page-flip npm package 2.0.2 is malware — full machine compromise; no safe version exists
https://helix.ml/threat-watch/i/pdf-html5-page-flip-npm-package-2-0-2-is-malware-full-machine-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-12
GitHub published advisory GHSA-j3hx-5mxx-43qh on 2026-11-12 flagging version 2.0.2 of the npm package pdf-html5-page-flip as malware (CWE-506, embedded malicious code). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. There are no patched versions and no known source code; the only remediation is removal of the package plus incident response, since uninstalling cannot guarantee removal of all malicious software. All secrets and keys on affected machines must be rotated from a clean computer. Reach appears limited (39 GitHub stars), but any installation is treated as compromised.
Do: Treat any machine with pdf-html5-page-flip 2.0.2 installed as fully compromised; isolate and forensically review it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and rebuild affected systems from trusted images where possible; Audit npm lockfiles and CI/CD environments for the package and block its installation; Review logs and network traffic for signs of attacker activity following installation

### [critical] carboniteapp npm malware: install-script exfiltrates host data and public IP to attacker Telegram bot
https://helix.ml/threat-watch/i/carboniteapp-npm-malware-install-script-exfiltrates-host-data-and-public-ip-to-attacker-telegram-bot · Supply chain · no-fix-needed · since 2026-11-12
The npm package carboniteapp is fully malicious: its install hook runs node index.js, which collects host information, resolves the victim's public IP via api.ipify.org, and exfiltrates the data to an attacker-controlled Telegram bot via api.telegram.org. The package has no legitimate functionality, so every published version (>0) is affected and there is no patched version. It was published to npm on 2026-05-06 and removed the same day; the GitHub advisory (GHSA-cvmm-h8r9-4278, CWE-506) was published 2026-11-12. Any developer or CI environment that installed carboniteapp should treat the host as compromised and rotate exposed secrets.
Do: Search dependency locks, CI logs and node_modules history for any install of carboniteapp and remove it; Treat machines/CI runners where it was installed as compromised; rotate credentials, tokens and keys accessible there; Review egress logs for connections to api.ipify.org and api.telegram.org around install times; Block those domains and audit other install scripts in the dependency tree

### [critical] Off-registry HTTP tarball dependency: @rfewqa-fes/mnm-doc-mcp npm package delivers arbitrary code on install
https://helix.ml/threat-watch/i/off-registry-http-tarball-dependency-rfewqa-fes-mnm-doc-mcp-npm-package-delivers-arbitrary-code-on-install · Supply chain · no-fix-needed · since 2026-11-12
GitHub advisory GHSA-3qjp-mvhh-w85g (via OpenSSF malicious-packages, source amazon-inspector) flags npm package @rfewqa-fes/mnm-doc-mcp version 1.0.0 as malicious. Its package.json declares its sole dependency, 'node-health-utils', as a plain-HTTP tarball URL at a bare IP (http://121.199.24.94/dl/health-utils-1.0.0.tgz) instead of a registry version. On npm install, whatever bytes that host returns are installed, including lifecycle scripts, with no version pin, integrity hash, or TLS — giving the IP's controller arbitrary code execution on every installer and enabling MITM tarball substitution. The shipped index.js is an inert MCP stub; the dependency is the delivery channel. No patched versions exist; the package should be removed, not updated.
Do: Remove/uninstall @rfewqa-fes/mnm-doc-mcp 1.0.0 from all projects and lockfiles; do not install or update it; Audit machines and CI that installed it for compromise and lifecycle-script execution; rotate credentials/tokens accessible from those environments; Search dependency trees for dependencies declared as HTTP/URL tarballs or bare-IP hosts and replace them with registry versions; Block outbound access to 121.199.24.94 and enforce registry-only installs with integrity checking (e.g., npm audit, lockfiles, --ignore-scripts where feasible)

### [critical] superlib_ex3 (npm): malicious multi-stage loader fetches second-stage payload from x.exxcube.fr on install
https://helix.ml/threat-watch/i/superlib-ex3-npm-malicious-multi-stage-loader-fetches-second-stage-payload-from-x-exxcube-fr-on-install · Supply chain · no-fix-needed · since 2026-11-12
The npm package superlib_ex3 has been identified as malware and published to the GitHub Advisory Database (GHSA-c87m-wh47-cqq5) on 2026-11-12, credited to OpenSSF's malicious-packages database. The package is a multi-stage loader: its install hook fetches and executes a second-stage payload from the attacker-controlled host x.exxcube.fr (observed retrieving https://x.exxcube.fr/postInstall in dynamic detonation). The package has no legitimate functionality; every published version is malicious, and no patched versions exist. Any project that installed superlib_ex3 as a dependency would have executed attacker code at install time, potentially leading to credential theft or further compromise. Affected users should remove the package and treat build environments as compromised.
Do: Remove superlib_ex3 from all dependency trees and lockfiles; audit for its presence; Rotate all secrets, tokens, and credentials accessible from CI/CD and developer machines that installed it; Rebuild affected artifacts from clean environments and review install logs for connections to x.exxcube.fr; Block the domain x.exxcube.fr at network egress; Audit npm install hooks and enable malware scanning / dependency allowlists

### [critical] fcefi-wdojs-util npm package: malicious multi-stage dropper executes hidden payload on require, evades CI/sandboxes (no CVE)
https://helix.ml/threat-watch/i/fcefi-wdojs-util-npm-package-malicious-multi-stage-dropper-executes-hidden-payload-on-require-evades-ci-sandboxes-no-cve · Supply chain · no-fix-needed · since 2026-11-11
fcefi-wdojs-util@1.0.0 on npm is malicious code with no legitimate utility function. Its index.js reads an undeclared _bz numeric array (~1000 bytes) from its own package.json, zlib-inflates it, and executes the result via the Function constructor on every require. The loader short-circuits when CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX are set, so it stays inert in scanning environments and runs only on developer and production hosts. A 2.89 MB hex-only file, lib/native.pkg_config, is consistent with an encrypted stage-2 payload. Any project that installed the package is exposed to arbitrary code execution; there are no patched versions, so removal is the only remediation.
Do: Remove fcefi-wdojs-util from all dependencies and lockfiles immediately; Audit hosts where the package was installed for signs of execution and stage-2 payloads; treat credentials on those hosts as compromised; Rotate secrets, tokens, and keys accessible from affected developer/production environments; Check package-lock.json / CI caches for the package and block it in dependency firewalls; Prefer lockfile pinning and provenance/allowlist checks for npm dependencies

### [critical] mock-data-sdk (npm) 1.0.1 — malicious package executes hidden payload that hunts credential, wallet and .env files
https://helix.ml/threat-watch/i/mock-data-sdk-npm-1-0-1-malicious-package-executes-hidden-payload-that-hunts-credential-wallet-and-env-files · Supply chain · no-fix-needed · since 2026-11-11
The npm package mock-data-sdk, advertised as a mock-data generator, contains malicious code in version 1.0.1. Its entrypoint concatenates base64-encoded payloads hidden in the mark fields of data/products_*.js files, decodes them and executes via the Function() constructor, with identifiers like 'Buffer', 'require' and 'process' reconstructed at runtime from an XOR-obfuscated table to evade string-based scanners. The exported getTransactions() API triggers execution on every call. The decoded payload loads python-shell and https, writes a Python script to /tmp/targets, and recursively walks the filesystem for files named with 'password', 'wallet', 'seed', 'privatekey' or '.env', enabling credential and wallet theft. Flagged by Amazon Inspector and credited to OpenSSF's malicious-packages database. No patched version exists; the package must be removed.
Do: Remove mock-data-sdk from all projects and lockfiles immediately; do not use any version; Rotate any credentials, API keys, wallet seeds or private keys stored on machines where the package was installed or getTransactions() was called; Audit hosts for /tmp/targets and signs of filesystem enumeration or exfiltration over https; Check CI/CD pipelines and dependency caches for the package and rebuild from clean environments; Block the package name in internal registries and add it to dependency-scanning denylists

### [critical] strutil-helpers-core (npm): malicious load-time dropper with sandbox evasion executes attacker code on require
https://helix.ml/threat-watch/i/strutil-helpers-core-npm-malicious-load-time-dropper-with-sandbox-evasion-executes-attacker-code-on-require · Supply chain · no-fix-needed · since 2026-11-11
The npm package strutil-helpers-core, advertised as lightweight string utilities (trim/capitalize/truncate), is malicious. Versions 1.0.1–1.0.5 ship undeclared native addons (Linux ELF and Windows PE .node files) plus a 3.7MB opaque .napi_cache blob. On require(), index.js silently loads the platform addon, which decrypts JavaScript staged to hidden /tmp paths (/tmp/.%u, %s.nc%lu.js) and executes it under node via fork/execlp on Linux or CreateProcessA on Windows. Before firing, it checks CI/sandbox indicators (GITHUB_ACTIONS, JENKINS_URL, etc.), container markers via /proc, and debugger/analysis-tool presence on Windows, evading analysis. This is a load-time dropper running attacker-controlled code on any host that installs and requires the package. No patched versions exist; the package should be removed entirely.
Do: Remove strutil-helpers-core from all dependency trees and lockfiles immediately; do not use any version; Audit hosts and CI runners that installed or required the package for staged files matching /tmp/.<pid> and *.nc*.js patterns and for post-install persistence; Rotate credentials, tokens, and secrets accessible from affected build machines and developer hosts; Check npm audit / lockfile history to identify when the package was introduced and what else may have run in those environments; Block the package name in internal registries and dependency firewall policies

### [critical] teahy-znrpz-util (npm): malicious package executes zlib-obfuscated payload via Function() on require, skipping CI environments
https://helix.ml/threat-watch/i/teahy-znrpz-util-npm-malicious-package-executes-zlib-obfuscated-payload-via-function-on-require-skipping-ci-environments · Supply chain · no-fix-needed · since 2026-11-11
GitHub Advisory Database (GHSA-53gf-4wh9-g7vw, credited to OpenSSF/amazon-inspector) flags the npm package teahy-znrpz-util version 1.0.0 as malicious code (CWE-506). On module load, index.js reads a numeric byte array hidden under a non-standard _bz key in package.json, decompresses it with zlib.inflateSync, and executes the resulting string via the Function constructor with require and __dirname bound in. Execution is gated by an early return when CI, GITHUB_ACTIONS, GITLAB_CI, TRAVIS, CIRCLECI, or SANDBOX environment variables are set, so the payload only runs on real developer or production hosts with full Node privileges. No patched version exists; the package has no legitimate use. Anyone who installed or required teahy-znrpz-util@1.0.0 outside CI is affected.
Do: Remove teahy-znrpz-util@1.0.0 from all dependency trees and lockfiles immediately; Treat any host where the package was required outside CI as compromised: rotate credentials, tokens, and keys accessible to Node processes; Audit install/require history and CI logs for the package name and _bz manifest key; Block the package name in npm registry proxies and internal artifact repositories; Scan developer and production machines for indicators of the obfuscated-loader pattern (zlib.inflateSync + Function constructor on package.json data)

### [critical] aurum-pay PyPI malware: remote code execution via hidden command execution on first SDK call
https://helix.ml/threat-watch/i/aurum-pay-pypi-malware-remote-code-execution-via-hidden-command-execution-on-first-sdk-call · Supply chain · no-fix-needed · since 2026-11-11
The PyPI package aurum-pay version 1.2.0 contains malicious code flagged by GitHub Advisory Database (GHSA-3rfx-vc65-vf5v), Amazon Inspector, and OpenSSF. On the first SDK API call, _boot_once() fetches a command from https://aurum-casino.com/sdk/ping and executes it via bash (Linux/macOS) or hidden PowerShell (Windows), disguised as telemetry. The payload downloads and executes a next-stage binary (Linux) or an obfuscated Python environment (Windows), establishes persistence, and enables remote control and arbitrary command execution. Anyone who installed and used aurum-pay 1.2.0 is compromised. No patched version exists; the package is classified as malware (CWE-506).
Do: Immediately remove aurum-pay from all environments and dependencies; Treat any machine that imported or used the package as compromised: isolate, reimage, and rotate all credentials and secrets accessible from it; Hunt for persistence mechanisms and unexpected binaries or Python environments on affected hosts; Block network access to aurum-casino.com; Audit dependency lockfiles and CI caches for traces of aurum-pay 1.2.0

### [critical] npm typosquat malware wave: redis-type-xyz, ioredis-xyz, express-helmet, helmify — full machine compromise on install
https://helix.ml/threat-watch/i/npm-typosquat-malware-wave-redis-type-xyz-ioredis-xyz-express-helmet-helmify-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-11
GitHub published four malware advisories on 2026-11-11 for npm packages redis-type-xyz (GHSA-vx4h-jq4c-3vg2), ioredis-xyz (GHSA-5r2x-xv5p-58vg), express-helmet (GHSA-w7c4-444m-w3r7, ~185 downloads/month) and helmify (GHSA-6hfj-gc9f-mprr, ~168 downloads/month). All versions (>=0) are flagged as embedded malicious code (CWE-506) with no patched versions and no known source code; the names mimic legitimate packages (redis, ioredis, helmet, helmify), indicating a typosquatting campaign. GitHub states any machine with these packages installed or running should be considered fully compromised, implying credential and secret theft with attacker control. Removal of the package does not guarantee removal of the malicious software.
Do: Check lockfiles and installed node_modules for redis-type-xyz, ioredis-xyz, express-helmet and helmify; remove them and rebuild from clean sources; Treat affected machines as fully compromised: rotate all secrets, keys, tokens and credentials stored or accessible on them, from a clean machine; Audit CI/CD runners and developer workstations that may have installed these packages for persistence and exfiltration; Verify dependencies resolve to the legitimate packages (redis, ioredis, helmet, helmify) and pin trusted versions; Review npm install logs and access logs for signs of execution or outbound connections

### [critical] oracle-redis npm package is malware — full host compromise, no safe version
https://helix.ml/threat-watch/i/oracle-redis-npm-package-is-malware-full-host-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-11-11
GitHub published a malware advisory (GHSA-h224-x97c-j5g7) for the npm package oracle-redis, flagged as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists, so any installation should be treated as a full compromise of the host. The advisory warns that attackers may have gained complete control of affected machines, meaning removal of the package does not guarantee removal of all malicious software. All secrets and keys stored on compromised computers should be rotated from a clean machine. Reach appears limited (~261 downloads/month), but any environment that installed the package is assumed compromised.
Do: Remove oracle-redis from all projects and lockfiles and block it in dependency policies; Treat every machine that ran it as fully compromised: rebuild/reimage hosts; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Audit logs and network traffic for signs of attacker access or exfiltration; Scan for persistence mechanisms and additional malware left behind

### [critical] Malicious npm package 'shraps' — full system compromise via embedded malware; no safe version exists
https://helix.ml/threat-watch/i/malicious-npm-package-shraps-full-system-compromise-via-embedded-malware-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-11
GitHub's malware advisory database published GHSA-qpr9-cqf6-8m73 on 2026-11-11 flagging the npm package 'shraps' as containing embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. The advisory warns that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. The package sees roughly 14 downloads per month, limiting reach, but any installation is treated as a compromise. There is no fix; remediation is limited to removal and incident response.
Do: Rotate all secrets and keys stored on any machine where shraps was installed, using a different, clean computer; Remove the shraps package from all systems and dependencies; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit dependency lockfiles and CI environments for shraps usage; Block/flag shraps in internal registries and dependency scanning

### [critical] @tomhundley npm packages (mypackagetest, condux, sparkdash, grafene): malware — full machine compromise; rotate all secrets
https://helix.ml/threat-watch/i/tomhundley-npm-packages-mypackagetest-condux-sparkdash-grafene-malware-full-machine-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-11
On 2026-11-11 GitHub published four malware advisories (GHSA-gfh2-8j8w-933m, GHSA-jgmp-2vff-26jw, GHSA-gpvw-6mq7-2h5w, GHSA-65fw-m4q2-8ffh) covering every published version of four npm packages under the @tomhundley scope: mypackagetest, condux, sparkdash and grafene. All are classified CWE-506 embedded malicious code with no patched versions; GitHub states any machine with the packages installed or running should be considered fully compromised, implying attacker control of the host and access to stored secrets and keys. Reach appears small (grafene ~18 downloads/month), but any consumer is affected. No fix exists — removal of the packages does not guarantee removal of the malicious software.
Do: Immediately remove all @tomhundley/* packages from every machine and CI environment; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage compromised hosts; audit for persistence and follow-on malware; Audit dependency lockfiles and block the @tomhundley npm scope; Review npm/CI logs for signs of exfiltration or unauthorized access

### [critical] npm malware wave: cronbits, taskpace, csvbits, jsonrail — malicious packages fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/npm-malware-wave-cronbits-taskpace-csvbits-jsonrail-malicious-packages-fully-compromise-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-11
GitHub's advisory database published four malware advisories on 2026-11-11 for npm packages cronbits (GHSA-8mrh-r693-wrfq), taskpace (GHSA-73wm-q362-6xp2), csvbits (GHSA-78j2-8cm9-6g34) and jsonrail (GHSA-qv92-rmvf-gfmp). All versions (>= 0) are affected, with no patched versions and no known source code, indicating likely typosquat or malicious-publish campaigns. GitHub states any computer with these packages installed or running should be considered fully compromised, with attacker control of the machine and exposure of stored secrets and keys. Removal of the package does not guarantee removal of all malicious software. No CVEs are assigned; exploitation is presumed wherever the packages were installed.
Do: Check lockfiles and node_modules for cronbits, taskpace, csvbits and jsonrail; remove them from all machines and CI runners; Rotate all secrets, API keys, SSH keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild or reimage affected machines rather than trusting package removal; audit for persistence mechanisms; Review npm install logs and CI history to determine exposure window and whether credentials were exfiltrated; Block these package names in internal registries and enable npm provenance/allow-list controls

### [critical] Malicious npm package flowbits — full compromise of installed systems (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-flowbits-full-compromise-of-installed-systems-no-cve · Supply chain · no-fix-needed · since 2026-11-11
GitHub published a malware advisory (GHSA-q97r-6qp3-r59x) for the npm package flowbits on 2026-11-11. Every version (>= 0) is classified as embedded malicious code with no patched version available. Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software it deployed. All secrets and keys on affected machines are at risk and must be rotated. Any developer, CI pipeline, or end user that installed flowbits from npm is affected. There is no fix — the only remediation is removal plus full incident response on affected hosts.
Do: Treat any machine with flowbits installed as fully compromised; isolate and forensically review it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove the flowbits package from dependencies, lockfiles, and caches; block it in your registry/proxy; Rebuild affected systems from trusted images where feasible; audit for persistence and follow-on malware; Check CI/CD and developer workstations for the package and review what those environments could access

### [critical] Malicious npm package ioredis-om-typed — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-ioredis-om-typed-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-11
GitHub's advisory database published a malware advisory (GHSA-66fx-r7cm-jxv6) for the npm package ioredis-om-typed, flagged as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists — the package itself is the attack. Any machine with the package installed or running should be treated as fully compromised, with the attacker potentially holding full control and access to secrets, keys, and credentials on that machine. Removal of the package does not guarantee removal of any malicious software it may have deployed. All developers and CI systems that installed the package are affected; there is no fix other than removal plus full incident response.
Do: Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean machine; Remove ioredis-om-typed from all projects, lockfiles, and CI caches; Rebuild affected machines/containers from trusted images; investigate for persistence and deployed malware; Audit logs and network egress for signs of attacker access; Block the package in npm/registry policy and dependency scanning

### [critical] cal-time-stamper npm package is malware — full machine compromise for any installer
https://helix.ml/threat-watch/i/cal-time-stamper-npm-package-is-malware-full-machine-compromise-for-any-installer · Supply chain · no-fix-needed · since 2026-11-11
GitHub published advisory GHSA-5xh5-qp4j-xjfx on 2026-11-11 flagging the npm package cal-time-stamper as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and there are no patched versions; the package has no known source code and gets roughly 10 downloads per month. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the code hands control to an outside entity, enabling secret and key theft. Removal of the package alone is not guaranteed to remove all malicious software it installed. Any developer or CI environment that installed it is affected; remediation requires machine-level cleanup and credential rotation, not just uninstalling the package.
Do: Treat any machine where cal-time-stamper was installed or run as fully compromised; rebuild from clean images where possible; Rotate all secrets, keys, tokens and credentials stored on affected machines immediately, from a different, clean computer; Remove the package from all projects, lockfiles and CI pipelines and block/audit for it in dependency checks; Hunt for persistence and follow-on malicious software on affected hosts; review access and network logs for exfiltration

### [critical] correct-calc (npm): malicious package fully compromises machines that install it; no safe version exists
https://helix.ml/threat-watch/i/correct-calc-npm-malicious-package-fully-compromises-machines-that-install-it-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-11
GitHub published a malware advisory (GHSA-fvf5-h3m3-g793) for the npm package correct-calc, flagged as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside actor; removing the package does not guarantee removal of all malicious software. Reach appears limited (~19 downloads/month), but any installation is treated as a compromise. Remediation requires removing the package and rotating all secrets and keys from a clean machine.
Do: Treat any machine with correct-calc installed as fully compromised; rebuild from a clean image; Rotate all secrets, keys, and credentials stored on affected machines, from a different computer; Remove the package and audit for persistence and follow-on malware; Audit dependency trees and CI systems for correct-calc and block/flag it in package registries and proxies

### [critical] 0sec-cli (npm): malicious package compromises machines that install it — rotate all secrets
https://helix.ml/threat-watch/i/0sec-cli-npm-malicious-package-compromises-machines-that-install-it-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-11
GitHub published a malware advisory (GHSA-9j97-6pqr-qvrx) for the npm package 0sec-cli, flagging version 0.28.10 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. All secrets and keys stored on affected machines should be treated as stolen. No patched version exists and no source code is known; the advisory recommends removal of the package while warning that removal may not eliminate all malicious software. The package shows ~1,068 monthly downloads and 605 GitHub stars, so some real-world exposure is plausible, though no specific victim organisations are named.
Do: Treat any machine with 0sec-cli installed as fully compromised; rotate all secrets and keys from a clean machine immediately; Remove the package and rebuild/reimage affected systems rather than trusting cleanup; Audit dependency lockfiles and CI environments for 0sec-cli and block it in registries/proxies; Review access logs and credentials (cloud keys, tokens, SSH) for signs of exfiltration

### [critical] xsdsh-purge-next (npm): malicious package compromises any machine where it is installed
https://helix.ml/threat-watch/i/xsdsh-purge-next-npm-malicious-package-compromises-any-machine-where-it-is-installed · Supply chain · no-fix-needed · since 2026-11-11
GitHub's advisory database published GHSA-qpc3-24mv-6qrp on 2026-11-11 flagging the npm package xsdsh-purge-next version 1.0.0 as embedded malware (CWE-506). The advisory states that any computer with the package installed or running should be considered fully compromised, implying the malicious code grants an outside entity full control of the host. All secrets and keys on affected machines should be treated as stolen. There are no patched versions and no known legitimate source code; the package (~190 downloads/month) should be removed, though removal cannot guarantee the malware is fully eradicated. No specific campaign name, actor, or attack date is given.
Do: Treat any machine where xsdsh-purge-next@1.0.0 was installed as fully compromised; rotate all secrets and keys from a clean machine immediately; Remove the package and rebuild/reimage affected systems rather than trusting cleanup; Audit CI/CD and developer machines for the package and review logs for post-install activity; Block xsdsh-purge-next in dependency allowlists and check lockfiles for transitive references

### [critical] humbility-shared PyPI malware: install-time host data exfiltration (no CVE)
https://helix.ml/threat-watch/i/humbility-shared-pypi-malware-install-time-host-data-exfiltration-no-cve · Supply chain · no-fix-needed · since 2026-11-11
GitHub advisory GHSA-79v2-94f6-j483 (published 2026-11-11, credited to OpenSSF/kam193) flags the PyPI package humbility-shared as malicious. Versions 0.0.1 and 0.0.2 override the install command in setup.py to execute code during installation, and installing the package or importing the module exfiltrates basic host information such as IP address and username; the package has no other legitimate purpose. It is classified under the PROBABLY_PENTEST category and the GENERIC-standard-pypi-install-pentest campaign, with limited risk but critical severity. No patched versions exist and no in-the-wild exploitation is documented. Anyone who installed or imported the package should treat the host as potentially compromised and remove the package.
Do: Remove humbility-shared from all environments and dependency trees; Audit hosts and CI systems where it was installed or imported for signs of data exfiltration (IP, username); Rotate credentials accessible from affected hosts; Block the package name in internal PyPI mirrors and dependency scanning; Review dependency lockfiles and pip install logs for historical use

### [critical] termchalk (npm): malicious package fully compromises machines that install it; no safe version exists
https://helix.ml/threat-watch/i/termchalk-npm-malicious-package-fully-compromises-machines-that-install-it-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-11
GitHub's malware advisory database published GHSA-727x-2mvh-8r5c on 2026-11-11 flagging the npm package termchalk as embedded malicious code (CWE-506). All versions (>=0) are affected and no patched version exists, so any installation is considered a full compromise with possible outside control of the machine. The advisory instructs that all secrets and keys on affected computers be rotated immediately from a different, clean machine, and warns that removing the package does not guarantee removal of all malicious software it installed. The package sees roughly 314 downloads per month. There is no fix; the only remediation is removal plus full incident response on any machine where it ran.
Do: Treat any machine with termchalk installed or run as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove termchalk and rebuild/reimage affected systems; do not assume removal cleans the machine; Audit for persistence and lateral movement from affected hosts; Block termchalk in npm registries, lockfiles, and CI pipelines

### [critical] chalks-log (npm): malicious logging package fully compromises machines that install it (no CVE)
https://helix.ml/threat-watch/i/chalks-log-npm-malicious-logging-package-fully-compromises-machines-that-install-it-no-cve · Supply chain · no-fix-needed · since 2026-11-11
GitHub's malware advisory database published GHSA-cm5x-2764-c8p9 on 2026-11-11 flagging the npm package chalks-log as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, meaning the attacker may have obtained full control, including access to secrets and keys. The package has low reach (~216 downloads/month) despite a claimed 23K GitHub stars, suggesting a typosquat or impersonation of a popular logging library. Removal of the package does not guarantee removal of all malicious software it installed. No fix is available; remediation is removal plus credential rotation.
Do: Remove chalks-log from all projects and machines immediately; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage compromised machines; do not assume package removal removes the malware; Audit dependency trees and lockfiles for chalks-log and block it in CI/registry policy; Review logs and network traffic for signs of exfiltration or attacker access

### [critical] kbmathlessons npm package is malware — full machine compromise, no safe version
https://helix.ml/threat-watch/i/kbmathlessons-npm-package-is-malware-full-machine-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-11-11
GitHub's advisory database published a malware advisory (GHSA-8cvx-wq76-pcwg, CWE-506 Embedded Malicious Code) for the npm package kbmathlessons. Every version (>= 0) is affected and there are no patched versions — the package itself is malicious, so no fix exists. GitHub states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets, keys, and credentials stored on the machine. Removal of the package does not guarantee removal of any malicious software it may have installed. All developers or CI systems that installed kbmathlessons are affected; the advisory was published and reviewed on 2026-11-11.
Do: Rotate all secrets, keys, tokens, and credentials stored on any machine where kbmathlessons was installed, using a different, clean computer; Rebuild or wipe affected machines and CI runners rather than just uninstalling the package; Audit systems for signs of compromise and persistence mechanisms left by the malware; Check dependency trees and lockfiles for kbmathlessons and block/reject the package in future installs

### [critical] prettlog (npm): malicious package fully compromises machines that install it; no safe version exists
https://helix.ml/threat-watch/i/prettlog-npm-malicious-package-fully-compromises-machines-that-install-it-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-11
GitHub published a malware advisory (GHSA-7m86-chx9-8rr7) for the npm package prettlog on 2026-11-11. Every version (>= 0) contains embedded malicious code (CWE-506) and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity, with theft of secrets and keys. Removal of the package does not guarantee removal of all malicious software it installed. Any developer, CI system, or end user who installed prettlog is affected; there is no safe version to upgrade to.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where prettlog was installed, using a clean computer; Remove prettlog from all projects, lockfiles and CI pipelines and rebuild affected environments from trusted images; Reimage or rebuild compromised machines; do not assume uninstalling the package removes the malware; Audit npm dependencies and lockfiles for prettlog and block/review installs of the package

### [critical] @solana-trade/core npm package is malware — full machine compromise, rotate all secrets and keys
https://helix.ml/threat-watch/i/solana-trade-core-npm-package-is-malware-full-machine-compromise-rotate-all-secrets-and-keys · Supply chain · no-fix-needed · since 2026-11-11
GitHub published a malware advisory (GHSA-rq54-jmqc-j8qj) for the npm package @solana-trade/core on 2026-11-11. The package contains embedded malicious code (CWE-506) and every published version (>= 0) is affected, with no patched version available. GitHub warns that any computer with the package installed or running should be considered fully compromised, implying the attacker may have full control of the machine, so removal of the package alone cannot be assumed to remove all malicious software. Anyone who installed this package — particularly developers in the Solana/crypto ecosystem, where key material is commonly stored — is affected. There is no fix; the only remediation is removal plus full secret rotation and host rebuild from a clean machine.
Do: Stop using and uninstall @solana-trade/core immediately; treat all affected machines as fully compromised; Rotate all secrets, API tokens, SSH keys, and crypto/wallet keys from a clean, uncompromised computer; Rebuild/reimage affected machines and audit for persistence mechanisms before returning them to service; Review CI/CD systems and build environments that may have installed the package for stolen credentials; Block the package in dependency policies and audit lockfiles and dependency caches for it

### [critical] Malicious npm package nj-logger — full host compromise; no safe version exists
https://helix.ml/threat-watch/i/malicious-npm-package-nj-logger-full-host-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-11
GitHub published advisory GHSA-6q28-3q3p-8x7c on 2026-11-11 flagging the npm package nj-logger as malware (CWE-506, embedded malicious code). Every published version (>=0) is affected and no patched version exists, so any installation is considered a compromise rather than a vulnerability. The advisory states that any computer with the package installed or running should be treated as fully compromised, implying the code grants an outside party full control of the host, enabling theft of secrets, keys and credentials and persistence beyond simple package removal. Reach appears limited (~1540 downloads/month), but any dependent project or developer machine that installed it is exposed. There is no fix; remediation is removal plus host-level incident response.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where nj-logger was installed, using a clean machine; Treat affected hosts as compromised: rebuild/reimage them and audit for persistence, backdoors and attacker access; Remove nj-logger from all projects, lockfiles and CI pipelines and block it in dependency policies; Audit logs and network egress for signs of exfiltration or command-and-control since installation; Check dependency trees and internal registries for other uses of the package before rebuilding

### [critical] rex-react-diag-tools-v1 (npm): malicious package compromises any machine where it is installed (no CVE)
https://helix.ml/threat-watch/i/rex-react-diag-tools-v1-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-11
GitHub's malware advisory database published GHSA-w3r9-3pw6-qg6q on 2026-11-11 flagging the npm package rex-react-diag-tools-v1 as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists, so the package must be treated as malware rather than a vulnerable dependency. Any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software it deployed. Reach appears limited (~292 downloads/month). No CVE is assigned. Remediation requires removal of the package plus full incident response, as no fix will be issued.
Do: Rotate all secrets and keys stored on any machine where the package was installed, using a different, clean computer; Remove rex-react-diag-tools-v1 from all projects and lockfiles and block it in dependency policies; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit systems for signs of compromise and review access logs and credentials used on affected hosts

### [critical] pt-logger-telemetry-eax0x1 (npm): malicious package fully compromises machines that install it
https://helix.ml/threat-watch/i/pt-logger-telemetry-eax0x1-npm-malicious-package-fully-compromises-machines-that-install-it · Supply chain · no-fix-needed · since 2026-11-11
GitHub's advisory database published a malware advisory for the npm package pt-logger-telemetry-eax0x1 on 2026-11-11. The package is classified as embedded malicious code (CWE-506) with all versions (>= 0) affected and no patched versions available. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host. There is no indication of a legitimate upstream project being compromised; this appears to be a typosquat-style or otherwise malicious package published to npm. Anyone who installed it should treat secrets and keys on the affected machine as stolen and rotate them from a clean machine. Removal of the package alone is not guaranteed to eliminate the malicious software.
Do: Immediately remove pt-logger-telemetry-eax0x1 from all systems and CI pipelines; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer; Rebuild affected machines from trusted images; do not assume package removal fully cleans the system; Audit dependency lockfiles and npm install logs for the package and check for other unexpected dependencies; Block the package name in internal registries and enable npm provenance/allowlist controls

### [critical] Malicious npm packages: @fadelsm/libsignal-node and @fadelsm/baileys — typosquat malware compromises hosts (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-packages-fadelsm-libsignal-node-and-fadelsm-baileys-typosquat-malware-compromises-hosts-no-cve · Supply chain · no-fix-needed · since 2026-11-11
GitHub's advisory database published two malware advisories on 2026-11-11 covering npm packages @fadelsm/libsignal-node and @fadelsm/baileys, both classified CWE-506 (embedded malicious code) with critical severity. Every version (>= 0) is affected and no patched versions exist. The packages appear to be typosquats of the legitimate libsignal and Baileys (WhatsApp) libraries. Any machine with the packages installed or running must be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of the malicious software. Downloads are low (~46/month for libsignal-node), limiting reach, but any installer is a victim. There is no fix — the packages must be removed and all secrets on affected hosts rotated from a clean machine.
Do: Immediately uninstall @fadelsm/libsignal-node and @fadelsm/baileys from all projects and machines; Treat affected machines as fully compromised: rebuild/reimage them; Rotate all secrets, keys, and credentials stored on affected machines from a different, clean computer; Audit dependency lockfiles and CI caches for the packages and block them in registry allowlists; Review logs for signs of attacker access or exfiltration after installation

### [critical] Malicious npm package yummy-bolts — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-yummy-bolts-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-11
GitHub published a malware advisory (GHSA-v9xg-mgjf-74xm) for the npm package yummy-bolts, flagging versions 1.0.0 through 1.4.0 as containing embedded malicious code (CWE-506). No patched versions exist; the package has no known source code. Any machine where the package was installed or executed should be considered fully compromised, with attacker access to secrets and keys. The package is low-volume (~12 downloads/month, 1 dependent repository), limiting reach, but every installation is treated as a successful compromise. Removal of the package does not guarantee removal of the malicious software it deployed. Remediation requires secret rotation from a clean machine and full incident response on affected hosts.
Do: Rotate all secrets, keys, and credentials stored on any machine where yummy-bolts was installed, using a clean computer; Remove the package and rebuild/reimage affected machines; do not assume removal cleans the system; Audit dependency trees and lockfiles for yummy-bolts versions 1.0.0–1.4.0 and block the package; Review CI/CD and developer environments for signs of compromise and unexpected outbound connections

### [high] Qubole: attacker used vendor AWS credentials to assume customer roles and exfiltrate S3 data
https://helix.ml/threat-watch/i/qubole-cross-account-trust-abuse-threat-actor-used-vendor-aws-iam-credentials-to-assume-customer-roles-enumerate-harvest · Supply chain · no-fix-needed · since 2026-11-09
Wiz CIRT, working with Sentra and Mandiant, reports that between 14 and 26 October 2026 a threat actor used IAM credentials from an AWS account that Qubole's platform uses (805246085872) to assume integration roles that customers had created to trust Qubole, presenting valid External IDs. Every role assumption the post attributes to the actor succeeded, and in most affected environments it was the only vendor-account activity that month, so the trust policies were simply still in place. Inside the customer accounts the actor enumerated storage, compute, databases, roles and KMS keys, read Lambda environment variables, Secrets Manager and SSM Parameter Store, checked harvested AWS, Entra ID and Okta credentials with TruffleHog, and downloaded S3 objects, in some cases whole buckets. The post names no vendor fix; the remediation it describes is customer-side: remove or narrow unused trust (a specific principal plus source-IP conditions), rotate External IDs and every credential the roles could read, revoke sessions already issued, and enable S3 data events. The post does not say how many customers were affected, only that there were multiple victim environments.
Do: Audit CloudTrail from 1 October 2026 for sts:AssumeRole where the caller account is 805246085872 and the source IP is not an AWS address; also review AssumeRole calls by IAM users AIDA3W7DIFLYOLTK63SFS and AIDAJYRRH5Y3A7AAJM2HW that come from non-AWS addresses, IPs 45.83.220.211, 185.209.199.73, 57.129.54.120 and 89.37.63.175, and session names prefixed quiam-; Rotate all credentials found in Lambda env vars, Secrets Manager and SSM Parameter Store, and validate Entra ID/Okta service principal secrets; Review S3 data events logs for GetObject/ListObjects exfiltration from integration roles; Remove unused third-party cross-account trust roles; where one is kept, narrow the trusted principal, add aws:SourceIp or aws:SourceVpce conditions, and rotate the External ID per role; Enable S3 server access logs/CloudTrail data events for sensitive buckets, and revoke active sessions for any integration role the actor assumed (rotating a credential does not end sessions already issued)

### [critical] @apexacc/cli npm package is malware — full machine compromise on install
https://helix.ml/threat-watch/i/apexacc-cli-npm-package-is-malware-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database has flagged the npm package @apexacc/cli as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists — the package itself is the attack. GitHub warns that any computer where the package is installed or running should be considered fully compromised, with the attacker potentially holding full remote control. The package shows ~9,090 downloads per month and 17 GitHub stars, so real-world exposure is plausible. Removal of the package does not guarantee removal of any malicious software it deployed. No CVE is assigned; the advisory was published and reviewed on 2026-11-10.
Do: Treat any machine with @apexacc/cli installed as fully compromised; isolate and forensically review it; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Remove the package from all projects, lockfiles and CI pipelines; block it in dependency policy; Rebuild affected systems from trusted images where compromise is suspected; Audit npm dependencies for other suspicious packages before reinstalling

### [critical] baidu-ti (npm): malicious package compromises any machine where it is installed
https://helix.ml/threat-watch/i/baidu-ti-npm-malicious-package-compromises-any-machine-where-it-is-installed · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-hwgp-r9x8-49cx) for the npm package baidu-ti, flagged as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists, so the package should be treated as malicious from the start rather than a compromised legitimate library. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, harvested secrets and keys, and deployed additional persistent malware. All developers or CI systems that installed baidu-ti are affected. There is no fix; remediation is removal plus credential rotation and host forensics/rebuild.
Do: Stop using and uninstall baidu-ti immediately; block it in dependency allowlists; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Rebuild or thoroughly forensically clean affected hosts; assume persistence and additional malware; Audit dependency lockfiles and CI caches for baidu-ti and review what the compromised hosts accessed; Check logs for outbound connections or suspicious activity since installation

### [critical] @rclaude/win32-x64 npm package is malware — full machine compromise for installers of version 0.2.1
https://helix.ml/threat-watch/i/rclaude-win32-x64-npm-package-is-malware-full-machine-compromise-for-installers-of-version-0-2-1 · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published GHSA-w584-99h6-6g9r on 2026-11-10 flagging npm package @rclaude/win32-x64 version 0.2.1 as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated. No patched versions exist and no known source code is listed, so the package cannot be safely used at any version. Anyone who installed 0.2.1 — likely developers on Windows x64 pulling a Claude-related native binary — is affected. Removal of the package does not guarantee removal of the malicious software.
Do: Treat any machine with @rclaude/win32-x64@0.2.1 installed as fully compromised; isolate it; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and rebuild/reimage affected systems; do not assume removal fully cleans the machine; Audit npm lockfiles and CI caches for the package and block it in dependency firewalls/allowlists; Review logs and network traffic for signs of attacker access following installation

### [critical] Malicious npm package solvit-cli — full machine compromise, no safe versions
https://helix.ml/threat-watch/i/malicious-npm-package-solvit-cli-full-machine-compromise-no-safe-versions · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published a malware advisory (GHSA-p4j3-63x4-qr3v, CWE-506 Embedded Malicious Code) for the npm package solvit-cli on 2026-11-10. Every published version (0.0.0-stage through 0.5.0) is flagged as malicious, with no patched versions available, meaning the package should be treated as compromised from its first release. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. The package sees roughly 2,027 downloads per month, so some number of developer machines may be affected. No CVE has been assigned and no common name for the malware has been reported.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine where solvit-cli was installed, using a different, clean computer; Remove solvit-cli from all machines and CI environments and audit for persistence mechanisms, as removal may not eliminate all malicious software; Rebuild or reimage affected machines from trusted images where feasible; Audit npm lockfiles and dependency trees for solvit-cli and block/flag it in package registries and CI; Review logs and network traffic for signs of exfiltration or attacker access following installation

### [critical] Malicious npm package modules-newline — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-modules-newline-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-5hjr-7qfq-x5m5) for the npm package modules-newline, flagged as CWE-506 embedded malicious code. All versions (>= 0) are affected and no patched version exists; the package has no known source code repository and receives roughly 66 downloads per month. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malicious code grants outside actors full control of the host. Anyone who installed the package is affected. There is no fix — remediation consists of removing the package, rotating all secrets and keys from a clean machine, and rebuilding/reimaging affected systems, since removal cannot guarantee all malicious software is eliminated.
Do: Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a clean computer; Remove modules-newline from all projects and lockfiles and block it in dependency policies; Reimage or rebuild affected machines; do not assume removal fully cleans the system; Audit systems for persistence, unauthorized access, and exfiltration indicators; Check CI/CD and developer environments for the package and any credentials they hold

### [critical] npm malware read-react-app-out — full machine compromise on install; rotate all secrets
https://helix.ml/threat-watch/i/npm-malware-read-react-app-out-full-machine-compromise-on-install-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-wfm4-3cjm-9545) on 2026-11-10 for the npm package read-react-app-out. Every published version (>= 0) is malicious and there are no patched versions; the package should not be used under any circumstances. Per the advisory, any computer where the package was installed or executed should be considered fully compromised, with control potentially handed to an outside entity. Attackers can steal secrets and keys and may persist beyond simple package removal. No CVE is assigned; weakness is CWE-506 (embedded malicious code). Removal of the package alone does not guarantee remediation of any malware it deployed.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine; Remove read-react-app-out from all projects and lockfiles and rebuild affected environments from trusted images; Audit affected machines for persistence and other malware; reimage if compromise is suspected; Block the package in npm registries/proxies and CI pipelines; Review npm install logs and dependency histories for other suspicious packages

### [critical] Malicious npm package css-import-order — full system compromise for installers (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-css-import-order-full-system-compromise-for-installers-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-wc5q-g53w-pg32 on 2026-11-10 flagging the npm package css-import-order as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists; the package should not be used under any circumstances. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets and keys. Reach appears limited (~172 downloads/month), but any installation is treated as a successful compromise. There is no fix — remediation consists of removing the package and rotating all credentials from a clean machine, since removal alone cannot guarantee the malware is eradicated.
Do: Treat any machine with css-import-order installed as fully compromised; isolate and rebuild it; Rotate all secrets, keys, and credentials stored on affected machines, from a different clean computer; Remove the package from dependencies and lockfiles; block it in CI and dependency firewalls; Audit build systems and developer machines for the package and signs of follow-on malware; Review npm install logs and CI history to identify when and where it was installed

### [critical] Malicious npm package read-react-app-test — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-read-react-app-test-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-rf9p-c6g8-r84w) for the npm package read-react-app-test on 2026-11-10. Every version (>= 0) is flagged as embedded malicious code (CWE-506) with no patched version available. Per the advisory, any computer where the package is installed or running should be considered fully compromised, with control potentially handed to an outside entity; removal of the package does not guarantee removal of the malicious software. All developers or CI systems that installed the package are affected. There is no fix — the only remediation is removal plus full incident response on affected machines.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine; Remove the package from all projects, lockfiles, and caches; Rebuild or wipe affected machines and CI runners; treat them as compromised; Audit npm dependency trees and lockfiles for the package and block it in registry proxies/allowlists; Review access logs and network activity from affected hosts for attacker persistence or exfiltration

### [critical] read-react-app-in (npm): malicious package compromises any machine where it is installed
https://helix.ml/threat-watch/i/read-react-app-in-npm-malicious-package-compromises-any-machine-where-it-is-installed · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-hc34-qc67-9qp4 on 2026-11-10 flagging the npm package read-react-app-in as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists; the package has no known source code. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially given to an outside entity. All developers, CI systems, and build machines that installed the package are affected. Removal of the package alone is not guaranteed to eliminate the malicious software. Remediation is incident-response driven: rotate all secrets and keys from a clean machine and rebuild affected hosts.
Do: Rotate all secrets, tokens, SSH keys, and credentials stored on machines where the package was installed, using a clean computer; Remove the package and rebuild/reimage affected developer machines and CI runners from trusted images; Audit npm lockfiles and install logs for read-react-app-in and any dependencies that pulled it in; Review access logs and network traffic from affected hosts for signs of attacker activity; Block the package in internal registries and dependency-scanning policies

### [critical] selectlist-polyfill-lite (npm): malicious package compromises any machine where it is installed; no patched version exists
https://helix.ml/threat-watch/i/selectlist-polyfill-lite-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-patched-version-exists · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-2wg4-r52x-r477 flagging the npm package selectlist-polyfill-lite as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists, meaning the package itself is malware rather than a legitimate library that was backdoored. Any computer where the package is installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package sees roughly 1,084 downloads per month. GitHub advises removing the package, rotating all secrets and keys stored on affected machines from a different computer, and warns removal may not eliminate all malicious software planted during installation. No fixed version is available; the only safe action is removal and host remediation.
Do: Remove selectlist-polyfill-lite from all projects and dependency trees immediately; Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a clean computer; Rebuild/reimage affected machines; removal of the package may not remove all malicious software; Audit dependency lockfiles and CI caches for the package and block it in registries/proxies; Review logs and network traffic for signs of compromise or exfiltration

### [critical] hissakdx-wix-ssr-callback-canary (npm): malicious package compromises any machine where it is installed (no CVE)
https://helix.ml/threat-watch/i/hissakdx-wix-ssr-callback-canary-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's Advisory Database published GHSA-pmjf-g9mp-9hrr on 2026-11-10 flagging the npm package hissakdx-wix-ssr-callback-canary as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. The package sees roughly 1190 downloads per month. There is no fix; remediation requires removing the package, rotating all secrets and keys from a clean machine, and rebuilding compromised systems.
Do: Remove hissakdx-wix-ssr-callback-canary from all projects and lockfiles and block it in your registry/proxy; Rotate all secrets, keys, and credentials stored on any machine where it was installed, using a clean computer; Rebuild or reimage affected machines; do not trust that removal removed the malware; Audit npm dependency trees and CI caches for the package and review logs for signs of compromise

### [critical] @mobile-platform/magnetic-components (npm): malicious package fully compromises machines that install it
https://helix.ml/threat-watch/i/mobile-platform-magnetic-components-npm-malicious-package-fully-compromises-machines-that-install-it · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published a malware advisory for the npm package @mobile-platform/magnetic-components on 2026-11-10. All versions (>= 0) contain embedded malicious code (CWE-506) and there are no patched versions; the package has been removed from the advisory's remediation path entirely. GitHub states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. The package saw roughly 1,779 downloads per month, so exposure is limited but real. Because the malware may persist beyond package removal, affected machines require forensic cleanup, and all secrets and keys stored on them must be rotated from a clean computer. No fix exists; removal of the package alone is not guaranteed to eliminate the malicious software.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a different, clean computer; Remove the package and rebuild/reimage affected machines, as removal may not eliminate the malicious software; Audit build systems and CI runners for the package and review logs for suspicious activity; Block the package name in dependency management and check lockfiles for transitive installs

### [critical] Malicious npm package commerce-utils — full system compromise via embedded malware (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-commerce-utils-full-system-compromise-via-embedded-malware-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-4m72-8w6v-x24q) for the npm package commerce-utils, versions 0.0.1 and 0.0.2, classified as CWE-506 embedded malicious code. The advisory states any computer with the package installed or running should be considered fully compromised, implying attacker control of the machine and access to secrets and keys. There are no patched versions and no known source code; the package (~733 downloads/month) should be treated as malicious rather than a vulnerable dependency. Anyone who installed these versions is affected. Remediation is removal of the package plus rotation of all secrets and keys from a clean machine, since removal cannot guarantee elimination of all malicious software.
Do: Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean computer; Remove commerce-utils 0.0.1/0.0.2 from all projects and lockfiles and block the package; Rebuild/reimage affected machines and audit for persistence mechanisms; Audit logs and systems for signs of attacker access following installation; Check CI/CD environments and dependency caches for the package

### [critical] health-relay-client (npm): malicious package versions 1.0.3–1.0.4 fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/health-relay-client-npm-malicious-package-versions-1-0-3-1-0-4-fully-compromise-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published a malware advisory for the npm package health-relay-client, flagging versions 1.0.3 and 1.0.4 as containing embedded malicious code (CWE-506). GitHub's standard malware wording states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. There are no patched versions and no known source code repository; the package sees roughly 171 downloads per month. Any developer or CI system that installed these versions should assume secret and key theft and treat removal of the package as insufficient to guarantee remediation. The advisory was published and reviewed on 2026-11-10.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine where health-relay-client 1.0.3 or 1.0.4 was installed, doing so from a clean computer; Remove the package and rebuild/reimage affected machines and CI runners from trusted images; Audit systems for signs of compromise and review logs for exfiltration or persistence; Block health-relay-client in dependency policies and check lockfiles and dependency trees for the affected versions

### [critical] Malicious npm package react-svg-chunk — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-react-svg-chunk-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-5mg5-p59w-76r5 on 2026-11-10 flagging the npm package react-svg-chunk as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched versions exist; the package has no known source code repository. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host. The package sees roughly 704 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software it installed. No CVE is assigned; remediation is incident response, not an upgrade.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine where react-svg-chunk was installed, using a clean machine; Remove react-svg-chunk from all projects and lockfiles and block it in dependency policy; Rebuild or thoroughly forensically clean affected machines; assume full compromise; Audit CI/CD runners and developer workstations for the package and signs of compromise; Check npm audit / advisory feeds and pin reviewed dependencies before future installs

### [critical] supership-scan npm package is malware — full machine compromise for installers (no CVE)
https://helix.ml/threat-watch/i/supership-scan-npm-package-is-malware-full-machine-compromise-for-installers-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-v62j-7p69-5q4q on 2026-11-10 flagging the npm package supership-scan version 1.0.0 as embedded malicious code (CWE-506). Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines should be treated as stolen. The advisory lists no patched versions and none will be provided, so the only remediation is removal plus incident response. Reach is limited (~334 downloads/month), but anyone who installed the package is exposed to credential theft and persistent compromise that uninstalling may not fully remove.
Do: Rotate all secrets, keys, tokens and credentials stored on machines where supership-scan was installed, using a clean computer; Remove supership-scan 1.0.0 from all projects and lockfiles and block the package in dependency policies; Rebuild/reimage affected machines and hunt for persistence, as removal may not eliminate implanted malware; Audit CI/CD and developer environments for exposure and review access logs for signs of misuse; Check dependency trees for the package and add npm provenance/scanning controls

### [critical] text-regexer (npm) 4.3.0 is malware — full machine compromise, no patched version
https://helix.ml/threat-watch/i/text-regexer-npm-4-3-0-is-malware-full-machine-compromise-no-patched-version · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-p4p5-f7j2-g67x on 2026-11-10 flagging version 4.3.0 of the npm package text-regexer as embedded malicious code (CWE-506). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched version exists; the advisory recommends removal of the package, though removal cannot guarantee elimination of all malicious software it may have installed. All secrets and keys stored on affected machines should be rotated immediately from a different, clean computer. Organisations using this package should treat affected hosts as compromised and perform forensic cleanup or rebuild.
Do: Remove text-regexer 4.3.0 from all projects and lockfiles immediately; Rotate all secrets, keys, and credentials stored on machines where the package was installed, from a clean computer; Rebuild or forensically clean affected machines; removal of the package does not guarantee removal of malware; Audit npm dependencies and CI environments for the package and block it going forward

### [critical] Malicious npm package typo-crypto fully compromises installed machines
https://helix.ml/threat-watch/i/malicious-npm-package-typo-crypto-fully-compromises-installed-machines · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory for the npm package typo-crypto, flagging it as embedded malicious code (CWE-506) with no safe version — all versions >= 0 are affected and no patched release exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Anyone who installed typo-crypto is affected; the package sees very low usage (~2 downloads/month), limiting reach, but any installation is treated as a successful compromise. Removal of the package alone is not guaranteed to remove the malicious software it installed. No fix is possible; the only remediation is removal plus full incident response.
Do: Treat any machine with typo-crypto installed as fully compromised; rotate all secrets and keys from a clean computer immediately; Remove the package and rebuild/reimage affected machines; do not assume removal clears the malware; Audit npm dependency trees and lockfiles for typo-crypto and similar typosquatted crypto packages; Review access logs and network traffic for signs of attacker control since installation; Block or flag typo-crypto in CI/CD and dependency scanning

### [critical] trgrip (npm): malicious package compromises any machine where it is installed; no safe version exists
https://helix.ml/threat-watch/i/trgrip-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-10
GitHub published advisory GHSA-fw89-fphx-4q5r on 2026-11-10 flagging the npm package trgrip as malware (CWE-506, embedded malicious code). Every version (>= 0) is affected and no patched version exists, so any installation is considered a full compromise of the host machine. The advisory warns that attackers may have obtained full control of affected computers, meaning removal of the package does not guarantee removal of the malicious software. All secrets and keys stored on affected machines should be treated as stolen. The package reportedly sees around 1,421 downloads per month. There is no fix; remediation is removal plus credential rotation and host forensics/rebuild.
Do: Remove trgrip from all projects and lockfiles immediately; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Rebuild or forensically clean affected hosts; do not assume package removal removed the malware; Audit CI/CD and developer machines that may have installed the package for signs of compromise; Check dependency trees and lockfiles for trgrip and block it in package registries/proxies

### [critical] Malicious npm package @2oolkit/hyperliquid-cli — full machine compromise, credential theft (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-2oolkit-hyperliquid-cli-full-machine-compromise-credential-theft-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published GHSA-qg83-c6x5-qw8f on 2026-11-10 flagging the npm package @2oolkit/hyperliquid-cli as malware (CWE-506, embedded malicious code). Versions 0.1.0 through 0.2.7 are affected and there are no patched versions — the package cannot be safely used at all. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, exfiltrated secrets and keys, and installed additional malicious software that removal of the package will not eliminate. The package appears to be a typosquat-style fake CLI targeting Hyperliquid crypto users, with roughly 2,671 monthly downloads. No CVE is assigned; remediation is incident response, not patching.
Do: Rotate all secrets, API keys, wallet keys and credentials stored on any machine where the package was installed, using a clean computer; Rebuild or wipe affected machines; do not rely on uninstalling the package; Audit for persistence, additional malware and signs of crypto-wallet or exchange compromise; Block/remove the package from dependency trees and lockfiles; check CI systems for exposure; Review logs for outbound connections or exfiltration since installation

### [critical] tchain-api (npm): malicious package versions 1.2.2–1.2.5 fully compromise installed machines; no patched versions
https://helix.ml/threat-watch/i/tchain-api-npm-malicious-package-versions-1-2-2-1-2-5-fully-compromise-installed-machines-no-patched-versions · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-353c-q3qh-4wwc on 2026-11-10 flagging npm package tchain-api versions 1.2.2 through 1.2.5 as containing embedded malicious code (CWE-506). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated from a clean computer. There are no patched versions and no known source code repository; the advisory states removal of the package cannot guarantee removal of all malicious software it installed. With roughly 229 downloads per month, exposure is limited but real, and the package should be treated as actively malicious rather than a vulnerable dependency.
Do: Remove tchain-api 1.2.2–1.2.5 from all machines and CI environments immediately; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer; Rebuild/reimage affected systems; do not assume package removal removes the malware; Audit for persistence, unauthorized access, and lateral movement from affected hosts; Block the package in dependency policies and check lockfiles for transitive installs

### [critical] Malicious npm packages sms-activate.js, discord-user-parser, discord-badge-parser, discordjs-dm-parse — full host compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-sms-activate-js-discord-user-parser-discord-badge-parser-discordjs-dm-parse-full-host-compromise · Supply chain · no-fix-needed · since 2026-11-10
On 2026-11-10 GitHub published four malware advisories (GHSA-jf8p-p2w6-p4jq, GHSA-pw65-2qrx-w636, GHSA-797w-f996-fcxh, GHSA-2mwc-vf9r-h94x) flagging four npm packages — sms-activate.js, discord-user-parser, discord-badge-parser and discordjs-dm-parse — as containing embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched versions exist, so the packages must be removed rather than upgraded. GitHub warns that any machine with these packages installed or running should be considered fully compromised, implying credential and secret theft by an outside party. Download volumes are low (7, 32, 2 and unknown per month), limiting reach, but the Discord-themed names suggest targeting of Discord bot developers. No exploitation details or campaign attribution are given.
Do: Remove all four packages from every project, lockfile and CI environment immediately; Rotate all secrets, tokens and keys (npm, Discord bot tokens, cloud credentials) stored on or accessible from affected machines, from a clean computer; Rebuild affected machines or containers from trusted images; do not assume removal of the package removes the malware; Audit logs and network egress for signs of exfiltration or unauthorized access; Block these package names in dependency policy and internal registries

### [critical] npm malware: @lemili9804/mcp-weather-server — malicious package fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/npm-malware-lemili9804-mcp-weather-server-malicious-package-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-qwfq-cw9x-55x4 on 2026-11-10 flagging the npm package @lemili9804/mcp-weather-server as embedded malicious code (CWE-506). Versions 1.0.3 and 1.0.6 are affected, with no patched versions available; the package has roughly 1,812 monthly downloads. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets and keys stored on the machine. Removal of the package alone is not guaranteed to remove all malicious software. No CVE is assigned; the advisory carries no EPSS score and no known source code repository exists for the package.
Do: Immediately rotate all secrets, API keys, tokens and credentials stored on any machine where the package was installed, using a clean, uncompromised computer; Remove @lemili9804/mcp-weather-server from all projects and lockfiles; Rebuild or wipe affected machines, as removal may not eliminate all malicious software; Audit systems for signs of compromise and unexpected outbound connections; Block the package in internal registries and dependency scanning

### [critical] @solana-common/utils npm package is malware — full machine compromise, no patched versions (GHSA-r533-jgcg-qr68)
https://helix.ml/threat-watch/i/solana-common-utils-npm-package-is-malware-full-machine-compromise-no-patched-versions-ghsa-r533-jgcg-qr68 · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-r533-jgcg-qr68) on 2026-11-10 for the npm package @solana-common/utils, flagging versions 1.0.0 through 2.0.12 as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with attackers potentially gaining full control of the machine. No patched versions exist and no source code is known; the package has no legitimate upstream. Exposure is limited (69 downloads/month, 2757 GitHub stars cited in the advisory metadata), but anyone who installed any listed version should treat secrets and keys on that machine as stolen. Removal of the package alone does not guarantee remediation, since malware may persist. Affected users must rotate all credentials from a clean machine and rebuild compromised hosts.
Do: Treat any machine with @solana-common/utils installed as fully compromised; rotate all secrets, keys, and credentials immediately from a clean machine; Remove the package and rebuild/reimage affected systems rather than attempting in-place cleanup; Audit dependency lockfiles and CI caches for the package and any versions 1.0.0–2.0.12; Review access logs and wallet/crypto activity for signs of exfiltration; Block the package in internal registries and proxy policies

### [critical] tailwind-kinetix npm package is malware — full machine compromise, no safe version exists
https://helix.ml/threat-watch/i/tailwind-kinetix-npm-package-is-malware-full-machine-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-fgxr-cqw4-cpp6) for the npm package tailwind-kinetix on 2026-11-10. Every published version (>= 0) contains embedded malicious code (CWE-506) and there are no patched versions — the package should be treated as malicious in its entirety. Any machine where the package was installed or executed must be considered fully compromised, with potential attacker access to secrets, keys, and credentials. The package sees roughly 331 downloads per month. Removal of the package does not guarantee removal of any malware it may have deployed. No CVE is assigned; the advisory recommends immediate secret rotation from a clean machine.
Do: Stop using and uninstall tailwind-kinetix; block it in npm policies and CI dependency checks; Rotate all secrets, keys, tokens, and credentials stored on or accessible from affected machines, using a clean computer; Rebuild/reimage affected machines and audit for persistence, backdoors, and exfiltration; Audit dependency lockfiles and install history for exposure to the package

### [critical] @unipswap/postcss-animate-units: malicious npm package fully compromises machines running it (no CVE)
https://helix.ml/threat-watch/i/unipswap-postcss-animate-units-malicious-npm-package-fully-compromises-machines-running-it-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-vh4f-84vw-hprv on 2026-11-10 flagging the npm package @unipswap/postcss-animate-units as embedded malicious code (CWE-506). All published versions (>= 0) are affected and no patched version exists; the package has no known source code. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, including access to secrets and keys. Reach appears limited (~13 downloads/month), but any installation is treated as an active compromise rather than a latent risk. Removal of the package alone is not guaranteed to remove the malicious software. There is no vendor fix; remediation is incident response on affected machines.
Do: Treat any machine with the package installed as fully compromised; isolate and forensically review it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and block/flag @unipswap/postcss-animate-units in npm registries and dependency allowlists; Audit dependency trees and CI caches for the package and rebuild affected artifacts from clean sources; Review logs for signs of attacker activity following installation

### [critical] @solarcraft/observix npm package is malware — full machine compromise on install
https://helix.ml/threat-watch/i/solarcraft-observix-npm-package-is-malware-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database has flagged the npm package @solarcraft/observix as malware (CWE-506, embedded malicious code), published 2026-11-10. All versions (>= 0) are affected and there are no patched versions — the package itself is the attack. Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. All secrets and keys on affected machines should be treated as stolen. No safe version exists; the only remediation is removal plus full credential rotation and system rebuild.
Do: Remove @solarcraft/observix from all machines and CI immediately; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected systems; do not assume removal of the package removes the malware; Audit npm lockfiles and dependency trees for the package and block it in registries/proxies; Review logs and network traffic for signs of exfiltration or attacker access

### [critical] agent-trace-kit (npm): malicious package compromises any machine where installed (no CVE)
https://helix.ml/threat-watch/i/agent-trace-kit-npm-malicious-package-compromises-any-machine-where-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-p844-4jjv-h39f) for the npm package agent-trace-kit on 2026-11-10. All versions (>= 0) contain embedded malicious code (CWE-506) and no patched versions exist. Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; secrets and keys on affected machines are at risk. Removal of the package does not guarantee removal of all malicious software it installed. No fixed version is available; the only remediation is removal plus full incident response.
Do: Rotate all secrets and keys stored on affected machines immediately, from a clean computer; Remove agent-trace-kit from all projects and lockfiles and block it in dependency policies; Rebuild/reimage affected machines; audit for persistence and attacker access; Review CI/CD and developer environments for exposure and credential use during compromise window

### [critical] Malicious nicegui npm package — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-nicegui-npm-package-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-q452-fhw8-f2rp) on 2026-11-10 for the npm package nicegui, flagging it as containing embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All secrets and keys on affected machines should be rotated immediately from a different, uncompromised computer. Removal of the package is recommended but may not remove all malicious software planted during installation. Organisations that installed the package should treat hosts as breached and rebuild them.
Do: Immediately rotate all secrets, keys, and credentials stored on or accessible from machines where the package was installed, using a clean computer; Remove the nicegui npm package from all systems and block it in dependency management; Rebuild or reimage affected machines; do not assume removal of the package eliminates the malware; Audit systems for signs of compromise and unauthorised access or persistence; Review CI/CD and developer environments for exposure to the package and rotate pipeline credentials

### [critical] neat-terminal-visualizer-84721 (npm): malicious package fully compromises machines that install it
https://helix.ml/threat-watch/i/neat-terminal-visualizer-84721-npm-malicious-package-fully-compromises-machines-that-install-it · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-xp8m-mppr-v6jw, CWE-506 Embedded Malicious Code) for the npm package neat-terminal-visualizer-84721 on 2026-11-10. Every version (>= 0) is malicious and there are no patched versions; the package is not a legitimate project with a flaw but outright malware. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity, so removing the package does not guarantee removal of all malicious software. All secrets and keys on affected machines should be treated as stolen. No exploitation details or campaign name are given; the advisory itself confirms the malicious code exists in the published package.
Do: Remove neat-terminal-visualizer-84721 from all systems and block it in dependency resolution; Rotate all secrets, keys, and credentials stored on any machine that installed or ran the package, using a clean machine; Rebuild/reimage affected machines; do not assume removal of the package removes the malware; Audit dependency lockfiles and CI environments for the package and review for signs of compromise

### [critical] Malicious npm package redeem-onchain-sdk compromises installer machines
https://helix.ml/threat-watch/i/malicious-npm-package-redeem-onchain-sdk-compromises-installer-machines · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-xv64-hqwm-65h3) for the npm package redeem-onchain-sdk, flagged as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host, enabling theft of secrets, keys and credentials. Anyone who installed the package is affected; there is no indication of a specific victim organisation. Remediation is removal of the package plus rotation of all secrets and keys from a clean machine, since uninstalling may not remove all malicious software.
Do: Rotate all secrets, API keys, SSH keys and credentials stored on any machine where the package was installed, using a different clean computer; Remove redeem-onchain-sdk from all projects, lockfiles and CI environments; Rebuild or wipe affected machines and audit for persistence mechanisms; Audit logs and network egress for signs of exfiltration or attacker access; Block the package in npm dependency policies and scan repositories for its presence

### [critical] agui-session-recorder npm package is malware — full machine compromise, no safe version
https://helix.ml/threat-watch/i/agui-session-recorder-npm-package-is-malware-full-machine-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published a malware advisory (GHSA-qvgh-c63m-fxr7) for the npm package agui-session-recorder on 2026-11-10. Every published version (>= 0) is flagged as embedded malicious code with no patched version available. The advisory states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control of the machine, including access to secrets, keys, and credentials. Removal of the package does not guarantee removal of all malicious software it may have installed. Any developer, CI system, or end user that installed the package is affected; there is no safe version to upgrade to.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine where the package was installed, using a clean machine; Rebuild or wipe affected machines rather than just uninstalling the package; Audit dependency lockfiles and CI caches for agui-session-recorder and block/reinstall from trusted sources; Review access logs and network traffic for signs of exfiltration or attacker persistence; Notify security teams of any systems where the package ran in production

### [critical] period-newline (npm): malicious package compromises any machine where it is installed; no safe version exists
https://helix.ml/threat-watch/i/period-newline-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-10
GitHub published advisory GHSA-39vr-m6q2-vq5c on 2026-11-10 flagging the npm package period-newline as malware (CWE-506, embedded malicious code). Every version (>= 0) is affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated. Removal of the package does not guarantee removal of the malicious software. All npm users who installed period-newline are affected; the remediation is full incident response, not a version upgrade.
Do: Treat any machine with period-newline installed as fully compromised; isolate and rebuild from clean images; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a different computer; Remove the package from all projects, lockfiles, and CI pipelines and audit for persistence mechanisms; Review npm dependency trees and CI logs for other installs of the package and any post-install activity; Block the package name in internal registries and dependency scanning

### [critical] Malicious npm package mcp-contract-tester compromises installers' machines
https://helix.ml/threat-watch/i/malicious-npm-package-mcp-contract-tester-compromises-installers-machines · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-34p7-qcxm-gc39) for the npm package mcp-contract-tester, flagged as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched versions exist. Any computer with the package installed or running should be considered fully compromised, with the attacker potentially having full control of the machine; secrets and keys stored on affected systems are at risk. The advisory recommends removing the package but warns removal may not eliminate all malicious software. The package has no known source code repository. Discovered and published 2026-11-10.
Do: Rotate all secrets and keys stored on any machine where mcp-contract-tester was installed, using a clean computer; Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software; Audit npm lockfiles and CI environments for the package and review for signs of compromise; Block the package in dependency management and monitor for related typosquat packages

### [critical] Malware in @web3-common/utils npm package — full machine compromise on install (no CVE)
https://helix.ml/threat-watch/i/malware-in-web3-common-utils-npm-package-full-machine-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published a malware advisory (GHSA-253f-9v83-pw5c) for the npm package @web3-common/utils version 1.0.0, classified as CWE-506 embedded malicious code. The advisory states any computer with the package installed or running should be considered fully compromised, with attackers potentially gaining full control, and recommends rotating all secrets and keys from a separate machine. The package has no fixed versions and no known source code, so removal is the only remediation and cannot guarantee the malicious software is gone. Reach appears limited (~34 downloads/month), but any environment that installed it is assumed compromised. No CVE is assigned; the package should be removed and affected machines rebuilt.
Do: Remove @web3-common/utils@1.0.0 from all projects and lockfiles; Rotate all secrets, keys, and credentials stored on machines where it was installed, using a clean computer; Rebuild or reimage affected machines; do not assume removal fully cleans the system; Audit npm dependency trees and CI caches for the package and block it in registry policy

### [critical] Malicious npm package fapshi 1.1.4 — full system compromise; no patched version exists
https://helix.ml/threat-watch/i/malicious-npm-package-fapshi-1-1-4-full-system-compromise-no-patched-version-exists · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-frmh-w7mm-6h56) on 2026-11-10 for the npm package fapshi, version 1.1.4, classified under CWE-506 Embedded Malicious Code. Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched version exists, so the only remediation is removal of the package plus incident response. The package sees roughly 103 downloads per month, so exposure is limited but real. Secrets and keys on affected machines must be treated as stolen and rotated from a clean computer, since removing the package cannot guarantee removal of all malicious software it may have deployed.
Do: Treat any machine with fapshi 1.1.4 installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove the fapshi package and rebuild/reimage affected systems rather than trusting cleanup; Audit dependency lockfiles and CI environments for fapshi and block its installation; Review logs and network traffic for signs of exfiltration or attacker access

### [critical] @erlanzz/baileys npm package — malicious code compromises any machine where it is installed
https://helix.ml/threat-watch/i/erlanzz-baileys-npm-package-malicious-code-compromises-any-machine-where-it-is-installed · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database published GHSA-f8j3-x796-h5cm on 2026-11-10 flagging the npm package @erlanzz/baileys as containing embedded malicious code (CWE-506). All published versions (>= 0) are affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Anyone who installed the package — likely developers seeking a WhatsApp/Baileys-style library — is affected. Removal of the package alone is not guaranteed to remove the malicious software. No CVE; treated as malware in the npm supply chain.
Do: Immediately rotate all secrets, keys, tokens and credentials stored on any machine where @erlanzz/baileys was installed, using a clean machine; Isolate and rebuild any machine or CI environment where the package was installed; do not trust removal of the package alone; Audit npm lockfiles and dependency trees for @erlanzz/baileys and block/remove it from all projects and caches; Review access logs and network traffic from affected hosts for signs of attacker control or exfiltration; Revoke and reissue npm, git and cloud credentials that may have been accessible from compromised hosts

### [critical] fragment-api-py 14.4.2 backdoor: PyPI TON wallet drainer steals seed-wallet funds on client startup
https://helix.ml/threat-watch/i/fragment-api-py-14-4-2-backdoor-pypi-ton-wallet-drainer-steals-seed-wallet-funds-on-client-startup · Supply chain · no-fix-needed · since 2026-11-10
Version 14.4.2 of fragment-api-py, a Python client for Telegram's Fragment marketplace that holds users' TON wallet seeds, was published to PyPI on 2026-11-08 with a backdoor. The release is the older 13.0.0 code with a hidden sweep_wallet_to_self() function that, on client startup (async with FragmentClient(seed=...)) or on execute_prepared(), sends all USDT and nearly all TON to attacker wallet UQAolfC7fyf__0H-1GzG9y5ZtV2CPC7yDno4W2cSVuYlJ6DU, leaving only fee reserves. Two wallets lost 0.88 and 43.98 TON; funds were cashed out on 2026-11-10. The release has no git tag, suggesting a compromised maintainer machine, stolen PyPI token, or insider. No clean fix exists; users must remove the package and treat seeds as compromised.
Do: Immediately uninstall fragment-api-py 14.4.2 and pin to a known-good version (e.g. 14.4.1) or remove entirely; Assume any wallet seed used with the package is compromised; move remaining TON/USDT to a new wallet with a fresh seed; Search site-packages for the attacker address UQAolfC7fyf__0H-1GzG9y5ZtV2CPC7yDno4W2cSVuYlJ6DU or 'sweep_wallet_to_self' strings; Check wallet transaction history for transfers to the attacker address and report losses; Run a dependency scan (e.g. vet) across manifests and lockfiles for known malicious packages

### [critical] @zanxiky/baileys (npm): trojanized Baileys fork silently subscribes victims to attacker WhatsApp channels
https://helix.ml/threat-watch/i/zanxiky-baileys-npm-trojanized-baileys-fork-silently-subscribes-victims-to-attacker-whatsapp-channels · Supply chain · no-fix-needed · since 2026-11-10
GitHub Advisory Database (GHSA-43rp-v8rh-9333, credited to OpenSSF's malicious-packages database) flags the npm package @zanxiky/baileys as malware. It is a trojanized fork of the legitimate Baileys WhatsApp library (@whiskeysockets/baileys). On connection it issues an authenticated w:mex newsletter FOLLOW mutation (query_id 7871414976211147) that silently subscribes every victim to attacker-controlled WhatsApp channels with hardcoded JIDs 120363399602691477@newsletter and 120363421563597486@newsletter. Legitimate Baileys never hardcodes channel JIDs or auto-follows on connect. All published versions (>0, =0.0.0-stage, =1.1.0) are malicious and there are no fixed versions. Detected via wormsign static analysis. Anyone who installed the package is affected; the fix is removal and use of the legitimate library.
Do: Remove @zanxiky/baileys from all projects and lockfiles immediately; do not use any version; Audit WhatsApp sessions/connections created while the package was installed and unlink unfamiliar sessions; Replace with the legitimate @whiskeysockets/baileys from a verified source; Check whether any attacker-controlled channels were followed on connected accounts and unfollow them; Review CI/CD and dependency resolution to ensure the package cannot be reintroduced

### [critical] lwd_uri_util (crates.io): malicious build.rs steals env credentials from release/publishing workstations (no CVE)
https://helix.ml/threat-watch/i/lwd-uri-util-crates-io-malicious-build-rs-steals-env-credentials-from-release-publishing-workstations-no-cve · Supply chain · no-fix-needed · since 2026-11-10
The crates.io crate lwd_uri_util, advertised as a URI canonicalization utility, contains malicious code in build.rs across all published versions (0.1.0–0.1.4). The lib.rs is benign string manipulation, but build.rs runs on every cargo build/check/IDE load, dumps the full process environment plus hostname and username to JSON, and POSTs it via curl (Unix) or hidden PowerShell (Windows) to three base64-obfuscated endpoints including webhook.site and a Cloudflare Worker tied to the author's handle. Gating markers (FASTLANE_, APPLE_ID, KEYSTORE_, CODE_SIGN, etc.) target release/signing workstations while suppressing CI usernames, aiming to capture CARGO_REGISTRY_TOKEN, GITHUB_TOKEN, AWS_* credentials and signing material. No patched version exists; the crate should be treated as compromised and removed.
Do: Remove lwd_uri_util from all dependency trees and purge Cargo.lock references; Rotate CARGO_REGISTRY_TOKEN, GITHUB_TOKEN, AWS and signing/keystore credentials on any machine that built the crate; Audit build machines for signs of exfiltration and re-secure release/publishing environments; Block the exfiltration domains (api.sdklfghaljksdhfkjasdfhlasdhfjklasdf.xyz, webhook.site/0a60608b-63de-480c-a441-38a8d107a9ea, session-check.sapho11.workers.dev); Pin and review build.rs scripts of third-party crates before building

### [critical] Malware in futrou npm package — full machine compromise for users of version 2.0.40
https://helix.ml/threat-watch/i/malware-in-futrou-npm-package-full-machine-compromise-for-users-of-version-2-0-40 · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database flagged the npm package futrou, version 2.0.40, as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists; the package has no known source code repository. The package sees roughly 1,270 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software installed as a result. Users should treat all secrets and keys on affected machines as stolen and rotate them from a clean machine.
Do: Remove futrou 2.0.40 from all systems and rebuild affected machines from trusted images; Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a different clean computer; Audit systems for persistence mechanisms and other malicious software left behind after removal; Check dependency trees and CI/CD environments for futrou usage and block the package

### [critical] Malicious npm packages: moltbook-api-helper, moltbook-health, nodecheck-health, npm-scanner — full compromise of installed hosts
https://helix.ml/threat-watch/i/malicious-npm-packages-moltbook-api-helper-moltbook-health-nodecheck-health-npm-scanner-full-compromise-of-installed-hos · Supply chain · no-fix-needed · since 2026-11-10
On 2026-11-10 GitHub published four malware advisories for npm packages moltbook-api-helper (GHSA-pgm4-9gwv-4gcr), moltbook-health (GHSA-fpfc-cq2r-8r2c), nodecheck-health (GHSA-x2vv-xjjr-m8c6) and npm-scanner (GHSA-pc5x-m587-83hh). All versions (>= 0) are affected and no patched versions exist; the packages contain embedded malicious code (CWE-506). GitHub states any computer with these packages installed or running should be considered fully compromised, giving an outside entity full control — meaning secrets and keys on affected machines are at risk and removal of the package does not guarantee removal of malicious software. moltbook-api-helper shows ~574 downloads/month; the others' download counts are unstated. There is no fix; remediation is removal plus credential rotation and host forensics/rebuild.
Do: Immediately stop using and uninstall the four packages from all systems; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild or thoroughly forensically clean affected hosts, as removal may not eliminate implanted malware; Audit dependency lockfiles and CI environments for these packages and block them in registries/proxies; Review logs for signs of exfiltration or unauthorized access

### [critical] Malicious npm ebook packages: dowload_ebok_* typosquat malware — full machine compromise, no patched versions
https://helix.ml/threat-watch/i/malicious-npm-ebook-packages-dowload-ebok-typosquat-malware-full-machine-compromise-no-patched-versions · Supply chain · no-fix-needed · since 2026-11-10
On 2026-11-10 GitHub published four malware advisories (GHSA-vr7m-h5f3-65qm, GHSA-h2q6-5m77-v63m, GHSA-246r-hxmh-2gmm, GHSA-p8fx-34wr-82fg) for npm packages posing as ebook downloads of works by Pope Francis, James Joyce, Giorgio Serafini Prosperi and Holger Karsten Schmidt. All versions (>=0) contain embedded malicious code (CWE-506) with no patched versions; GitHub states any machine with the package installed or running should be considered fully compromised, implying attacker control and access to secrets and keys. Download volumes are low (2-4 per month), suggesting a broad typosquat-style campaign rather than a targeted breach. Removal of the package does not guarantee removal of the malware.
Do: If any of these packages were installed, treat the machine as fully compromised: rotate all secrets, keys, tokens and credentials from a clean computer; Rebuild or wipe affected machines rather than just uninstalling the package; Audit dependency trees and CI/CD environments for these or similar dowload_ebok_* package names; Block the package names in npm registries/proxies and monitor for related typosquat uploads; Review npm install logs to determine exposure window and what credentials may have been accessible

### [critical] Malicious npm package @fmr-ap149494/apex-base-component — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-fmr-ap149494-apex-base-component-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database flagged the npm package @fmr-ap149494/apex-base-component as embedded malicious code (CWE-506), published 2026-11-10. All versions (>= 0) are affected and no patched version exists; the package should not be used at all. Per the advisory, any computer where the package was installed or run should be considered fully compromised, implying the malware grants outside attackers control of the machine, exposing secrets, keys and credentials. Anyone who installed the package as a dependency is affected. There is no fix beyond removal; remediation requires rotating all secrets from a clean machine and forensic review, since removal of the package cannot guarantee removal of all malicious software it deployed.
Do: Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different clean computer; Remove the package from all projects and lockfiles and block/audit for it in npm dependencies; Rebuild affected machines or perform forensic cleanup, as removal may not eliminate all malicious software; Review CI/CD and developer environments for compromise and audit access logs

### [critical] @factoryz/apollo npm package is malware — full machine compromise on install
https://helix.ml/threat-watch/i/factoryz-apollo-npm-package-is-malware-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database (GHSA-7q6h-g3hp-prq6, published 2026-11-10) flags the npm package @factoryz/apollo as containing embedded malicious code (CWE-506). All published versions (>= 0) are affected and there are no patched versions — the package itself is the attack. GitHub warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software it deployed. Any developer or CI environment that installed the package is affected; secrets and keys stored on those machines are at risk. No fix exists; remediation is removal plus incident response.
Do: Treat any machine where @factoryz/apollo was installed or run as fully compromised; rotate all secrets and keys from a clean machine; Remove the package and rebuild/reimage affected hosts and CI runners; Audit logs and network traffic for signs of attacker access or exfiltration; Block/avoid the package in npm installs and lockfiles; check dependency trees for it

### [critical] @fcsmc/commercial-analytics npm package is malware — full machine compromise on install
https://helix.ml/threat-watch/i/fcsmc-commercial-analytics-npm-package-is-malware-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database has flagged the npm package @fcsmc/commercial-analytics as containing embedded malicious code (CWE-506). All published versions (>= 0) are affected and there are no patched versions — the package itself is the attack. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the machine, enabling theft of secrets, keys and credentials. No source code repository is known. Any developer or CI environment that installed the package is affected; removal of the package alone cannot be assumed to remove the malicious software.
Do: Rotate all secrets, keys and credentials stored on any machine where the package was installed, using a different, clean computer; Remove the package and rebuild/reimage affected machines from trusted images; do not assume removal fully cleans the system; Audit npm lockfiles and CI logs for any use of @fcsmc/commercial-analytics and block the package; Review access logs and cloud accounts for signs of compromise since installation; Notify security teams and rotate tokens exposed in developer or CI environments

### [critical] Malicious npm package @fmr-ap153177/apex-kit-icons — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-fmr-ap153177-apex-kit-icons-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database flagged the npm package @fmr-ap153177/apex-kit-icons as containing embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists, so any installation grants the attacker full control of the machine. GitHub's guidance states computers with the package installed or running should be considered fully compromised, implying secrets and keys on those machines are exposed. The package sees roughly 852 downloads per month. The advisory was published, reviewed and last updated on 2026-11-10. Removal of the package alone is not guaranteed to eliminate the malicious software it installed. Organisations using this scope should treat affected build machines and developer workstations as breached and rotate all credentials from a clean machine.
Do: Remove @fmr-ap153177/apex-kit-icons from all projects and lockfiles; Rotate all secrets, keys and credentials stored on machines where it was installed, from a clean computer; Reimage or rebuild affected developer workstations and CI machines; Audit npm dependencies and block the @fmr-ap153177 scope; Review logs and endpoints for signs of compromise

### [critical] Malicious npm package @futurae-public/adaptive-js — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-futurae-public-adaptive-js-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub published advisory GHSA-xcfm-cvqm-rcwc on 2026-11-10 flagging the npm package @futurae-public/adaptive-js as malware (CWE-506, Embedded Malicious Code). All versions (>= 0) are affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, implying the malicious code grants outside actors full control of the machine, exposing secrets, keys and credentials. Any developer or CI environment that installed the package is affected. There is no fix; remediation consists of removing the package and rotating all secrets from a clean machine, as removal alone cannot guarantee the malware is eradicated.
Do: Treat any machine where the package was installed or executed as fully compromised; rebuild from clean images; Rotate all secrets, keys, tokens and credentials stored on affected machines, using a different clean computer; Remove the package from all projects, lockfiles and CI pipelines and block it from being installed again; Audit logs and network traffic for signs of exfiltration or attacker access; Investigate for persistence mechanisms and residual malicious software before restoring trust in the systems

### [critical] Malicious npm package @generic-means/ing-feat-scanner-libs — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-generic-means-ing-feat-scanner-libs-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published a malware advisory (GHSA-77gv-vj6m-6qg6) for the npm package @generic-means/ing-feat-scanner-libs, flagged as CWE-506 embedded malicious code. All published versions (>= 0) are affected and no patched version exists. The advisory warns that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the machine. Secrets and keys stored on affected machines are at risk and must be rotated. There is no indication of a specific victim organisation; impact depends on who installed the package. Removal of the package alone is not guaranteed to eliminate the malicious software. No fix is available; the only remediation is removal plus host forensics and credential rotation.
Do: Remove @generic-means/ing-feat-scanner-libs from all projects and dependency trees immediately; Treat affected machines as fully compromised: rotate all secrets, keys, and credentials from a clean computer; Rebuild or reimage affected hosts; do not assume package removal removes the malware; Audit npm lockfiles and CI caches for the package and block it in dependency scanning; Review access and activity logs for signs of attacker control

### [critical] @jm-telefonica/multibrand-components npm package contains malware — full machine compromise
https://helix.ml/threat-watch/i/jm-telefonica-multibrand-components-npm-package-contains-malware-full-machine-compromise · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database flagged the npm package @jm-telefonica/multibrand-components as containing embedded malicious code (CWE-506), published 2026-11-10. Every published version (>= 0) is affected and no patched version exists, so any installation should be treated as a deliberate compromise rather than a vulnerable dependency. The advisory warns that any computer with the package installed or running should be considered fully compromised, with attackers potentially holding full remote control, and that removing the package cannot guarantee removal of all malicious software it deployed. Reach appears limited (~814 downloads/month), but anyone who installed it is exposed to secret and key theft. There is no fix; remediation is removal plus credential rotation and host forensics.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine where the package was installed, using a clean machine; Remove the package from all projects and lockfiles and audit for persistence mechanisms it may have deployed; Rebuild/reimage affected machines and review access logs for signs of attacker activity; Audit CI/CD environments and dependency caches for the package and block it in registry allowlists

### [critical] Malicious npm package @postex/common — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-postex-common-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-10
GitHub Advisory Database entry GHSA-fq53-vhhm-rqf7, published 2026-11-10, identifies the npm package @postex/common as malware. All versions (>= 0) are affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; secrets and keys on affected machines must be rotated. Weakness is classified as CWE-506 (Embedded Malicious Code). No source code repository is known. Any developer or CI environment that installed the package is affected; removal of the package alone does not guarantee removal of malicious software it may have deployed.
Do: Rotate all secrets, keys, and credentials stored on machines where @postex/common was installed, using a clean computer; Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software; Audit dependency lockfiles and CI pipelines for any use of @postex/common and block the package; Review logs and network traffic for signs of compromise or exfiltration from affected hosts

### [critical] leveldb-edit (npm): malicious package compromises any machine where installed; no safe version exists
https://helix.ml/threat-watch/i/leveldb-edit-npm-malicious-package-compromises-any-machine-where-installed-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-10
GitHub published a malware advisory (GHSA-86wj-q33p-q8r9) for the npm package leveldb-edit, classifying it as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of malicious software. The package is low-reach (~100 downloads/month, 8 GitHub stars) but any installation is treated as a successful compromise. Remediation requires removing the package and rotating all secrets and keys from a clean machine.
Do: Treat any machine with leveldb-edit installed as fully compromised; isolate and rebuild it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a different clean computer; Remove the package from dependencies and lockfiles; audit installs for persistence beyond the package itself; Check CI/CD and developer environments for the package and any post-install execution artifacts; Block leveldb-edit in npm installs and monitor for typosquatted variants

### [critical] @openyard/vetcode npm package — malicious code in versions 0.3.0 and 0.3.1 fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/openyard-vetcode-npm-package-malicious-code-in-versions-0-3-0-and-0-3-1-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's advisory database published a malware advisory (GHSA-gq67-8gph-p33v) for the npm package @openyard/vetcode, flagging versions 0.3.0 and 0.3.1 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with attackers potentially having full remote control. No patched versions exist; the package has no known source code and improvements are not accepted on the advisory. All users of these versions are affected. Removal of the package alone is not guaranteed to eliminate malicious software planted during installation. Secrets and keys on affected machines must be rotated immediately from a clean computer.
Do: Immediately rotate all secrets, keys, and credentials stored on machines where @openyard/vetcode 0.3.0 or 0.3.1 was installed, using a different clean computer; Remove the package from all projects and lockfiles and audit for persistence mechanisms, as removal may not eliminate all malicious software; Rebuild or wipe affected machines and CI environments; Audit npm dependency trees for the package and block it in dependency firewalls/registries; Review logs and network traffic for signs of exfiltration or attacker access

### [critical] npm malware: @conduitops/logview-archive — malicious package fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/npm-malware-conduitops-logview-archive-malicious-package-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-10
GitHub's malware advisory database has flagged the npm package @conduitops/logview-archive as embedded malicious code (CWE-506). All published versions (>= 0) are affected and there are no patched versions — the package itself is the malware. GitHub warns that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets, keys and credentials stored on the machine, and that removal of the package does not guarantee removal of all malicious software it may have deployed. Any developer or CI environment that installed the package is affected. No fix exists; remediation is removal plus full compromise response.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine where the package was installed, using a clean machine; Rebuild or wipe affected machines and CI runners rather than just uninstalling the package; Audit systems for signs of persistence or attacker access following the compromise; Remove @conduitops/logview-archive from all projects, lockfiles and dependency caches; Block the package in npm/CI policy checks and review how it entered the dependency tree

### [critical] fastapi-code-generator: RCE via unescaped operation summary in generated handler docstring (CVE-2026-63470)
https://helix.ml/threat-watch/i/fastapi-code-generator-rce-via-unescaped-operation-summary-in-generated-handler-docstring-cve-2026-63470 · Supply chain · patched · since 2026-07-01 · CVE-2026-63470
fastapi-code-generator, which turns an OpenAPI file into a FastAPI application, copies each operation's summary into the generated route handler's docstring without escaping triple double quotes. A summary containing three double quotes can close that docstring early and continue the handler's first statement with an arbitrary Python expression, which runs every time the route is called. The generator does not execute the injected code. Exposure requires that someone other than the app's developers can influence the spec the generator reads: a third-party or remotely fetched spec, a service that builds apps from uploaded specs, or a spec change that is regenerated and deployed unreviewed. A proof of concept is attached to the advisory; no in-the-wild exploitation is reported, the CVE is not in CISA KEV, and EPSS is 0.005. The fix is in 0.8.1 (released 2026-07-01), which escapes the summary for the docstring context. Apps generated with 0.8.0 or earlier should be regenerated with 0.8.1 and their handler docstrings checked for injected expressions.
Fixed: fastapi-code-generator 0.8.1
Do: Upgrade fastapi-code-generator to 0.8.1 and regenerate all FastAPI apps from your specs; Audit already-generated code for suspicious concatenated expressions in handler docstrings, especially where summaries came from third-party specs; Restrict which parties can supply or influence OpenAPI specs used for code generation; Add CI checks flagging """ sequences or __import__ calls in generated handler docstrings

### [critical] price-scripping-js (npm): malicious package compromises any machine where it is installed (no CVE)
https://helix.ml/threat-watch/i/price-scripping-js-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-09
GitHub published a malware advisory (GHSA-54cm-q9wq-9442) for the npm package price-scripping-js, classified under CWE-506 Embedded Malicious Code. Every version (>= 0) is affected and no patched version exists; the package has been removed from legitimate use and should be treated as fully compromising any machine where it is installed or running. Attackers gain full control of the host, exposing all secrets and keys stored on it. Reach is limited (~324 downloads/month), but any installation is assumed compromised. There is no fix — remediation consists of removing the package, rotating all credentials from a clean machine, and rebuilding/reimaging affected systems, since removal cannot guarantee all malicious software is eliminated.
Do: Rotate all secrets, keys, and credentials stored on affected machines immediately, using a different, clean computer; Remove price-scripping-js from all projects and dependency trees; Reimage or rebuild affected machines; do not assume removal of the package eliminates the malware; Audit systems for signs of compromise and review access logs; Block the package in dependency firewalls/allowlists and scan builds for it

### [critical] npm typosquat malware wave: charape, @bestcoolman/dev-mcp, polymarket-stake-mathss, js-price-client-node — malicious packages fully compromise hosts
https://helix.ml/threat-watch/i/npm-typosquat-malware-wave-charape-bestcoolman-dev-mcp-polymarket-stake-mathss-js-price-client-node-malicious-packages-f · Supply chain · no-fix-needed · since 2026-11-09
On 2026-11-09 GitHub published four malware advisories for npm packages: charape, @bestcoolman/dev-mcp (~152 downloads/month), polymarket-stake-mathss (~929 downloads/month), and js-price-client-node (~276 downloads/month). Each is classified as embedded malicious code (CWE-506) affecting all versions (>= 0) with no patched versions, meaning the packages cannot be safely used at any release. Per the advisories, any computer with these packages installed or running should be considered fully compromised, with attackers potentially gaining full control and access to secrets and keys; removal of the package does not guarantee removal of the malicious software. No CVEs were assigned. Users of these packages should treat hosts as compromised and rotate credentials immediately.
Do: Stop using and remove the four packages from all projects and lockfiles; Rotate all secrets, API keys, tokens and credentials stored on affected machines, from a clean computer; Rebuild/reimage compromised machines; audit for persistence since removal may not eliminate malware; Review CI/CD and developer environments for exposure and audit npm dependency trees for related typosquats

### [critical] npm malware wave: archetype-index-sdk, file-saver-bg, react-bootstrap-table2-toolkit-bg, react-bootstrap-table-next-bg — full machine compromise
https://helix.ml/threat-watch/i/npm-malware-wave-archetype-index-sdk-file-saver-bg-react-bootstrap-table2-toolkit-bg-react-bootstrap-table-next-bg-full · Supply chain · no-fix-needed · since 2026-11-09
On 2026-11-09 GitHub published four malware advisories for npm packages: archetype-index-sdk (versions 0.0.0-stage and 1.0.0), file-saver-bg (all versions, ~460 downloads/month), react-bootstrap-table2-toolkit-bg (all versions, ~414 downloads/month), and react-bootstrap-table-next-bg (all versions). All are classified CWE-506 embedded malicious code with no patched versions; GitHub's guidance states any computer with the packages installed or running should be considered fully compromised, implying active credential theft by an outside party. The packages appear to be typosquat-style clones of legitimate libraries (file-saver, react-bootstrap-table2 toolkit/next) with a '-bg' suffix. No fixed versions exist; removal is the only remediation, and it may not remove all malicious software.
Do: Check lockfiles and installed node_modules for these four package names and remove them immediately; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild affected machines or containers from trusted images rather than trusting cleanup; Audit npm CI/CD and developer machines for unexpected installs and review registry dependency resolution/typosquat protections; Monitor for anomalous network activity and credential use following removal

### [critical] @ethersphere/bee-js 13.3.0: malicious npm release steals Swarm wallet files and plants persistence
https://helix.ml/threat-watch/i/ethersphere-bee-js-13-3-0-npm-supply-chain-compromise-wallet-theft-and-persistence-via-stolen-release-identity · Supply chain · no-fix-needed · since 2026-11-09
On 2026-11-09 at 00:09:50 UTC a malicious 13.3.0 of @ethersphere/bee-js, the ethersphere JavaScript client for Ethereum Swarm, was published to npm. StepSecurity traces it to an unsigned commit pushed the previous day at 23:59:54 UTC under the bee-worker release identity, which moved a version script from prepare to postinstall; the published package still carried valid SLSA provenance because the legitimate release workflow built that source. At install time the hook requests a platform-specific JavaScript payload from api.frameworkmetrics[.]xyz and runs it through the Function constructor. The Linux and macOS payloads look for config.yaml and data-dir/keys/swarm.key in the Swarm Desktop data directory and install a user service or LaunchAgent disguised as Solidity tooling; the Windows path stages an MSI in a hidden %LOCALAPPDATA% directory and adds a Microsoft Defender exclusion for it. GitHub lists GHSA-hh7j-5m3j-23pf as critical with no fixed version. At research time the npm registry no longer lists 13.3.0 and its latest tag points at 13.2.0, whose registry metadata has no install hook; the writeup does not say whether npm removed the version. Anyone who installed 13.3.0 with lifecycle scripts enabled should treat the machine as fully compromised and rotate wallet and other secrets from a clean system. @ethersphere/swarm-cli 3.7.0 and @ethersphere/bee-dashboard 0.37.1 depend on ranges that would have resolved to 13.3.0 on a fresh install while it was latest; no source says they contain injected code.
Do: Do not install @ethersphere/bee-js 13.3.0; pin to 13.2.0 or a safe version and audit dependency ranges that could resolve to 13.3.0; If 13.3.0 was installed with lifecycle scripts enabled, treat the host as fully compromised: rotate all secrets and keys from a clean machine; Check for and remove persistence: ~/.solidity/ payloads and .run.py or .run.cjs launchers; ~/.config/systemd/user/solidity-langsupport-runner.service (Linux); ~/Library/LaunchAgents/com.solidity.langsupport.runner.plist (macOS); ScreenConnect-named installs, hidden %LOCALAPPDATA% directories named with a GUID, and Defender exclusions (Windows); Hash-check any ~/.solidity/linux_amd64 or linux_arm64 file against SHA-256 9b73e7cd4e1425e770392549d8df46c706139ef476f4f7b9ac405165dc8d9696 and b601776817363b96295119f7221338a122d5247a35a77a64b04f286e1bbcc565 (values published by StepSecurity); Check Swarm Desktop data directory for accessed config.yaml and data-dir/keys/swarm.key; assume wallet keys compromised and move funds/rotate wallet credentials; Block api.frameworkmetrics[.]xyz at network egress and hunt for connections to it, including the paths /v1/analytics, /v1/assets/ and /v1/swarm/report; Check lockfiles and dependency trees for @ethersphere/swarm-cli 3.7.0 (depends on ^13.2.0) and @ethersphere/bee-dashboard 0.37.1 (depends on ^13.0.0), which would have resolved to 13.3.0 on a fresh install while it was latest; Reinstall affected systems from trusted images rather than only uninstalling the package

### [critical] npm malware wave: focashi, dsh-ungate, @aaron205whitmore/postcss-animate-utils, template-cards — malicious packages fully compromise hosts
https://helix.ml/threat-watch/i/npm-malware-wave-focashi-dsh-ungate-aaron205whitmore-postcss-animate-utils-template-cards-malicious-packages-fully-compr · Supply chain · no-fix-needed · since 2026-11-09
On 2026-11-09 GitHub added four malware advisories for npm packages: focashi (all versions), dsh-ungate (0.2.3), @aaron205whitmore/postcss-animate-utils (all versions), and template-cards (all versions). Each is classified CWE-506 embedded malicious code with no patched versions; GitHub warns any machine with the packages installed or running should be considered fully compromised, with attacker control implying secret and key theft. No common malware family name is given and no source code is known. Anyone who installed these packages is affected; removal alone is not guaranteed to eliminate the malicious software. No fixes exist — remediation is removal plus credential rotation and host rebuild.
Do: Check lockfiles and installed node_modules for focashi, dsh-ungate, @aaron205whitmore/postcss-animate-utils and template-cards; remove them and quarantine affected machines; Rotate all secrets, tokens, SSH keys and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected hosts rather than trusting removal of the package; Audit CI/CD and developer environments for exposure and review npm install logs for when compromise occurred; Block the package names in internal registries and monitor for reinstall attempts

### [critical] Malicious npm packages @velliajs/discord and @velliajs/telegram — full host compromise; rotate all secrets
https://helix.ml/threat-watch/i/malicious-npm-packages-velliajs-discord-and-velliajs-telegram-full-host-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-09
On 2026-11-09 GitHub published malware advisories GHSA-rrh4-2mwf-4xw7 and GHSA-9hfr-xx64-hrq4 for the npm packages @velliajs/discord and @velliajs/telegram, flagging them as embedded malicious code (CWE-506) with all versions (>= 0) affected and no patched versions. Any machine with these packages installed or running must be considered fully compromised, with attacker access to secrets and keys. The packages masquerade as Discord/Telegram client libraries; @velliajs/discord shows ~302 monthly downloads and a claimed 26K GitHub stars, suggesting typosquat-style social engineering. Removal of the package alone is not guaranteed to remove all malicious software, since full host control may have been ceded. No fix exists; remediation is removal plus credential rotation and host rebuild.
Do: Immediately remove @velliajs/discord and @velliajs/telegram from all projects and lockfiles; Rotate all secrets, API keys, tokens and credentials stored on affected machines, from a clean computer; Rebuild or reimage affected hosts; do not assume package removal removed the malware; Audit install/CI logs for the packages and check for persistence mechanisms and exfiltration; Block the packages in npm registries and dependency firewalls

### [critical] Malicious npm package winks.tunnelsql — full compromise of installed machines; no safe version exists
https://helix.ml/threat-watch/i/malicious-npm-package-winks-tunnelsql-full-compromise-of-installed-machines-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-09
GitHub Advisory Database published GHSA-4rrg-994x-267f on 2026-11-09 flagging the npm package winks.tunnelsql as embedded malware (CWE-506). All versions (>= 0) are affected and no patched version exists; the package has been removed from distribution guidance entirely. Any machine with the package installed or running must be considered fully compromised, with attacker control implying potential theft of secrets, keys, and credentials and persistence beyond simple package removal. Reach appears limited (~30 downloads/month), but every installation is treated as a successful compromise. There is no fix; remediation is removal plus full secret rotation and host rebuild from a clean machine.
Do: Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a different, clean computer; Remove the winks.tunnelsql package from all projects and lockfiles; Rebuild/reimage affected hosts; do not assume removal of the package removes the malware; Audit systems for persistence mechanisms and signs of attacker activity; Block the package in dependency firewalls/CI to prevent reintroduction

### [critical] Malicious npm package zhg.sql — full host compromise; no safe version exists
https://helix.ml/threat-watch/i/malicious-npm-package-zhg-sql-full-host-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-09
GitHub published advisory GHSA-43j9-6qvj-9hgc on 2026-11-09 flagging the npm package zhg.sql as embedded malware (CWE-506). All versions (>= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and removal of the package does not guarantee removal of all malicious software. The package sees roughly 22 downloads per month, so reach is limited, but any installation constitutes active compromise. There is no fix; remediation is host-level incident response, not a version upgrade.
Do: Treat any machine with zhg.sql installed as fully compromised; isolate it immediately; Rotate all secrets, keys, and credentials stored on affected machines from a clean computer; Remove the package and rebuild/reimage affected hosts; do not assume removal cleans the system; Audit dependency trees and CI/CD environments for zhg.sql and review access logs for signs of attacker control; Block the package in npm registries and internal mirrors

### [critical] gpa-core (npm): malicious package fully compromises machines that install it; no safe version exists
https://helix.ml/threat-watch/i/gpa-core-npm-malicious-package-fully-compromises-machines-that-install-it-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-09
GitHub's advisory database published GHSA-g3w4-qv32-7ccr on 2026-11-09 flagging the npm package gpa-core as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and there are no patched versions; the package has no known source code and pulls roughly 422 downloads per month. GitHub states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. Any developer or CI environment that installed gpa-core is affected; secrets and keys on those machines must be treated as stolen. No fix exists — remediation is removal plus credential rotation and host forensics/rebuild.
Do: Stop using gpa-core immediately and remove it from all projects, lockfiles and CI pipelines; Rotate all secrets, keys, tokens and credentials stored on any machine where it was installed, from a clean computer; Rebuild or forensically clean affected machines; assume full compromise; Audit logs and network traffic for signs of exfiltration or attacker access; Check dependencies for typosquatting or other malicious packages before reinstalling

### [critical] Malicious npm package @chatbridgeworld/baileys — full host compromise; rotate all secrets
https://helix.ml/threat-watch/i/malicious-npm-package-chatbridgeworld-baileys-full-host-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-09
GitHub's malware advisory database published GHSA-fjhf-q8f8-r96j on 2026-11-09 flagging the npm package @chatbridgeworld/baileys as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control of the host, including access to secrets, keys and credentials. The package is a typosquat-style clone of the Baileys WhatsApp library with roughly 909 weekly downloads. Removal of the package does not guarantee removal of any malware it installed. Organisations that installed it must treat all credentials on affected machines as stolen and rotate them from a clean machine.
Do: Isolate and rebuild any machine where the package was installed or run; do not trust the existing OS; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Audit for persistence mechanisms and lateral movement from affected hosts; Remove the package from dependencies and lockfiles and block it in CI/registry allowlists; Review logs for outbound connections or data exfiltration since installation

### [critical] Malicious npm package yonzofficial — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-yonzofficial-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-09
GitHub published a malware advisory (GHSA-7hh5-mmvx-fw3m) for the npm package yonzofficial on 2026-11-09. All versions (>= 0) are classified as embedded malicious code (CWE-506) with no patched version available. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity; removal of the package does not guarantee removal of the malicious software. The package sees roughly 1,255 downloads per month, so any developer or CI environment that installed it is at risk of credential and secret theft. There is no fix; remediation is removal plus full incident response on affected hosts.
Do: Rotate all secrets, keys, and credentials stored on or accessible from machines where yonzofficial was installed, using a clean machine; Isolate and rebuild any computer or CI runner that installed the package; do not trust removal of the package alone; Audit npm lockfiles and dependency trees for yonzofficial and remove it from all projects; Review access logs and monitor for suspicious outbound connections or unauthorized activity on affected hosts; Block the package in internal registries and dependency-scanning tooling

### [critical] Malicious npm packages: @dikaaofficial/libsignal-node and @dikaaofficial/eslint-config — embedded malware compromises installers' machines
https://helix.ml/threat-watch/i/malicious-npm-packages-dikaaofficial-libsignal-node-and-dikaaofficial-eslint-config-embedded-malware-compromises-install · Supply chain · no-fix-needed · since 2026-11-09
GitHub's advisory database published malware advisories on 2026-11-09 for two npm packages under the @dikaaofficial scope: @dikaaofficial/libsignal-node (GHSA-xpqj-qc3m-679c) and @dikaaofficial/eslint-config (GHSA-cqvc-q8rj-f4pp, ~15 downloads/month). Both are flagged as embedded malicious code (CWE-506) with all versions (>= 0) affected and no patched versions. GitHub states any computer with the packages installed or running should be considered fully compromised, implying attackers can gain full control, steal secrets and keys, and persist beyond simple package removal. No source code repository is known. Affected users must rotate all secrets and keys from a clean machine and rebuild compromised systems.
Do: Remove both packages from all projects and lockfiles and audit for other @dikaaofficial packages; Rotate all secrets, API keys, tokens and credentials stored on or accessible from affected machines, using a clean computer; Reimage or rebuild affected machines; do not assume removal of the package removes the malware; Review CI/CD and developer environments that may have installed these packages and check for persistence and exfiltration; Block the @dikaaofficial npm scope in internal registries and dependency firewalls

### [critical] @liauto npm packages (linux-arm64, linux-x64, darwin-arm64, cli) — malware, full host compromise, no safe version
https://helix.ml/threat-watch/i/liauto-npm-packages-linux-arm64-linux-x64-darwin-arm64-cli-malware-full-host-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-11-09
GitHub's advisory database published four malware advisories on 2026-11-09 for the @liauto npm packages: linux-arm64, linux-x64, darwin-arm64, and cli. All versions (>= 0) are flagged as containing embedded malicious code (CWE-506) with no patched versions available. The advisories state any machine with these packages installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host, enabling secret and credential theft. Combined downloads are roughly 3,500/month, so exposure is limited but real. Removal of the packages alone is not guaranteed to eliminate the malicious software. No CVEs are assigned; remediation is host-level incident response and credential rotation.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the @liauto packages and rebuild/reimage affected hosts; do not assume removal fully cleans the system; Audit CI/CD runners, developer machines, and containers for the packages and for signs of compromise; Check lockfiles and dependency trees for @liauto packages and block them in registry proxies/allowlists; Review access logs and network egress for indicators of compromise since installation

### [critical] Malicious npm packages @gqb333/based and @gqb333/baileys — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-packages-gqb333-based-and-gqb333-baileys-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-09
GitHub's Advisory Database published two malware advisories (GHSA-f562-w3mr-phwc, GHSA-h5vw-cqfg-mwhp) on 2026-11-09 for the npm packages @gqb333/based and @gqb333/baileys, both classified CWE-506 Embedded Malicious Code. Every version (>= 0) is affected and no patched versions exist. The advisories state that any computer with the packages installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal of the package does not guarantee removal of the malicious software. Anyone who installed either package is affected; the packages appear to be typosquat-style malicious publications under the @gqb333 scope (baileys mimicking the popular WhatsApp library name). No fix is available; remediation is host-level incident response and secret rotation.
Do: Treat any machine where @gqb333/based or @gqb333/baileys was installed or executed as fully compromised; rebuild from trusted images; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Remove the packages from dependencies and lockfiles; block the @gqb333 npm scope in registry proxies; Audit affected hosts for persistence, unauthorized access and exfiltration; review CI/CD and developer workstations; Check npm audit / dependency scans for these packages across all projects

### [critical] Malicious npm package @polymarkets/clob-client-v2 — full host compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-polymarkets-clob-client-v2-full-host-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-09
GitHub's advisory database published a malware advisory (GHSA-j4hq-4959-hgrr, CWE-506 Embedded Malicious Code) for the npm package @polymarkets/clob-client-v2, which impersonates the legitimate Polymarket CLOB client. All versions (>= 0) are affected and no patched version exists; the package should never be installed. GitHub states any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, harvested secrets and keys, and deployed additional persistence that survives package removal. The package sees roughly 279 downloads per month. Remediation requires removing the package, rotating all secrets and keys from a clean machine, and forensic review of affected hosts.
Do: Remove @polymarkets/clob-client-v2 from all projects and lockfiles and block it in your registry/proxy; Rotate all secrets, API keys, tokens and credentials stored on any machine where it was installed, using a clean computer; Rebuild affected machines from trusted images; check for persistence, as removal may not eliminate implanted malware; Audit CI/CD and developer machines for the package and review logs for suspicious outbound activity

### [critical] Malicious npm package @devmikets/hyperliquid-sdk compromises developer machines
https://helix.ml/threat-watch/i/malicious-npm-package-devmikets-hyperliquid-sdk-compromises-developer-machines · Supply chain · no-fix-needed · since 2026-11-09
GitHub published a malware advisory (GHSA-c2g6-qg53-pvqq) for the npm package @devmikets/hyperliquid-sdk, which impersonates a Hyperliquid trading SDK. All versions (>= 0) are affected and no patched version exists; the package embeds malicious code (CWE-506) that gives an outside entity full control of any machine where it is installed or running. Anyone who installed it should treat the computer as fully compromised and rotate all secrets and keys stored on it from a separate, clean machine. Removing the package does not guarantee removal of all malicious software it may have deployed. The advisory was published and reviewed on 2026-11-09; the package sees roughly 280 downloads per month.
Do: Immediately rotate all secrets, API keys, and private keys (especially crypto/trading keys) from a clean machine, not the compromised one; Isolate and rebuild any machine where the package was installed; do not trust removal of the package alone; Audit npm dependency trees and lockfiles for @devmikets/hyperliquid-sdk and block/remove it; Review access logs and wallet/exchange accounts for signs of compromise; Hunt for persistence mechanisms and additional malware the package may have dropped

### [critical] Malware in @hello.nrfcloud.com/proto-map npm package — full machine compromise; rotate all secrets
https://helix.ml/threat-watch/i/malware-in-hello-nrfcloud-com-proto-map-npm-package-full-machine-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-09
The GitHub Advisory Database published a malware advisory (GHSA-mc5j-m8rr-4m27, CWE-506 Embedded Malicious Code) for the npm package @hello.nrfcloud.com/proto-map, versions 18.0.0 and 18.1.0. GitHub classifies the package as fully malicious with no patched versions available, and states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. Roughly 2,616 downloads per month are affected. Removal of the package is advised but cannot be guaranteed to remove all malicious software. No fix exists; remediation is removal plus credential rotation from a clean machine.
Do: Immediately remove @hello.nrfcloud.com/proto-map versions 18.0.0 and 18.1.0 from all projects and lockfiles; Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean computer; Rebuild affected systems from trusted images; do not assume removal fully cleans the machine; Audit npm dependency trees and CI caches for the package and block it in dependency policy; Review logs for signs of exfiltration or unauthorized access

### [critical] 2025-11-spellcheckers campaign: logger-libs (PyPI) — malicious package downloads and executes remote payload (no CVE)
https://helix.ml/threat-watch/i/2025-11-spellcheckers-campaign-logger-libs-pypi-malicious-package-downloads-and-executes-remote-payload-no-cve · Supply chain · no-fix-needed · since 2026-11-09
GitHub Advisory Database (GHSA-vw9j-7fh8-35gf, published 2026-11-09) flags the PyPI package logger-libs as malicious under the '2025-11-spellcheckers' campaign tracked by OpenSSF and researcher kam193. Versions 0.4.1, 0.4.2, 0.4.3, 0.4.5 and 0.4.6 contain obfuscated code split across multiple files and reconstructed at runtime, which downloads and executes a malicious script from a remote location and can run remote commands on the victim's machine. The campaign is assessed as clearly malicious, likely infostealer functionality, and has been linked to Python RAT delivery in related packages. No patched versions exist; the package should be treated as compromised and removed. Anyone who installed these versions is affected.
Do: Immediately uninstall logger-libs and remove it from all requirements files, lockfiles and CI images; Audit affected hosts for signs of compromise, credential theft and persistence; rotate secrets, tokens and keys accessible from those environments; Check dependency trees and build caches for other packages from the 2025-11-spellcheckers campaign; Block the package and its indicators in artifact repositories and proxy caches; Review pip install logs to identify when and where the malicious versions were installed

### [critical] u-chan-secrets npm package malware: full machine compromise, rotate all secrets
https://helix.ml/threat-watch/i/u-chan-secrets-npm-package-malware-full-machine-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-09
GitHub's malware advisory database flagged the npm package u-chan-secrets as containing embedded malicious code (CWE-506). Versions 5.2.1 and 5.2.2 are affected and no patched versions exist; the package has been removed from the advisory's fix path entirely. Any machine with the package installed or running should be treated as fully compromised, with an outside entity potentially holding full control. The package sees roughly 1,722 downloads per month, so downstream developers and CI environments may be affected. The advisory was published and reviewed on 2026-11-09. Because attackers may have deployed additional persistence, removing the package does not guarantee removal of all malicious software. Organisations should rotate all secrets and keys from a clean machine and rebuild affected systems.
Do: Rotate all secrets, keys, and credentials stored on any machine where u-chan-secrets 5.2.1 or 5.2.2 was installed, using a different clean computer; Remove the package and rebuild/reimage affected machines and CI runners, as removal may not eliminate attacker persistence; Audit dependency lockfiles and block/reinstall from trusted sources; check for suspicious post-install activity and network connections

### [high] Fake security tools on GitHub: malicious repos deliver AsyncRAT, clipper and infostealer
https://helix.ml/threat-watch/i/fake-security-tools-on-github-malicious-repos-targeting-cybersecurity-pros-deliver-asyncrat-clipper-and-infostealer · Supply chain · no-fix-needed · since 2026-11-05
Dr.Web researchers report a campaign running for about two years that began with crypto and gaming lures (blockchain games, bots, cheat tools) and now targets security professionals with a fake script that claims to parse and format Fscan scanner output. At the time of its research, Dr.Web counted more than 2,000 infected PCs; the report gives no date for that count, no repository count, and no repository names or popularity figures. Hidden code sits behind long runs of whitespace in Visual Studio project files (some run it from pre-build events), and in Python and Go sources. PowerShell retrieves the Electron-based loader 'Microsoft.exe' (Dr.Web's Trojan.Loader.3261). The loader elevates privileges; disables Windows Defender, UAC, notifications, System Restore and Volume Shadow Copy; switches off Smart App Control; unhooks ntdll and uses direct syscalls, ETW and AMSI patching, and Defender exclusions to evade detection; and edits the hosts file so that AV vendor domains become unreachable. It also removes ESET, McAfee and Malwarebytes and interferes with Windows backups. The final payloads are AsyncRAT, a clipboard crypto-address swapper, and an infostealer that sends browser data, VPN and FTP configs, gaming account data and Discord tokens to a Telegram bot. No vendor fix exists and no GitHub response is reported; defence is vetting repositories before building them, blocking the loader and published IOCs, and rotating credentials where exposure is suspected.
Do: Audit endpoints for the published Doctor Web IOCs (Trojan.Loader.3261 list) and for the loader 'Microsoft.exe', AsyncRAT and clipper indicators; Block developer machines from running unreviewed scripts or build events from GitHub repos; inspect Visual Studio project pre-build events and hidden whitespace in source files; Enforce application allowlisting and keep Defender/EDR, Smart App Control, and tamper protection enabled; Restrict developer workstations' access to browser-stored credentials, VPN/FTP configs, and Discord tokens; rotate credentials if exposure is suspected; Verify backup integrity and monitor for antivirus removal and for hosts-file changes that block AV vendor domains

### [critical] env-test-guard (crates.io): malicious Rust test crate exfiltrates CI tokens via webhook.site and DNS (no CVE)
https://helix.ml/threat-watch/i/env-test-guard-crates-io-malicious-rust-test-crate-exfiltrates-ci-tokens-via-webhook-site-and-dns-no-cve · Supply chain · no-fix-needed · since 2026-11-09
The Rust crate env-test-guard, posing as a Git test toolkit, contains malicious code in GitEnv::detect() that steals CI credentials. Version 0.3.0 reads GITHUB_TOKEN, GH_TOKEN, INPUT_GITHUB_TOKEN and INPUT_CLAUDE_CODE_OAUTH_TOKEN, encrypts them with an embedded passphrase and POSTs them to a webhook.site endpoint via curl; version 0.2.0 leaks INPUT_GITHUB_TOKEN and INPUT_CLAUDE_CODE_OAUTH_TOKEN in cleartext via nslookup DNS lookups to buri.dns.praetorianlabs.com. Nothing runs at build time; execution occurs in any test or program calling GitEnv::detect(), typically on CI runners where tokens are set. Versions 0.2.0 and 0.3.0, published 2026-03-24/25, remain available on crates.io with no fixed versions. Discovered via OpenSSF and published to the GitHub Advisory Database on 2026-11-09.
Do: Remove and ban env-test-guard (all versions) from all Cargo.toml/lockfiles and internal registries; Rotate GITHUB_TOKEN, GH_TOKEN, INPUT_GITHUB_TOKEN and INPUT_CLAUDE_CODE_OAUTH_TOKEN secrets on any CI runner that ran tests using the crate; Audit CI logs and DNS/webhook egress for connections to webhook.site/fcd2a057-9288-4ac1-9c62-e6f57e6c7403 or buri.dns.praetorianlabs.com; Check whether any exfiltrated tokens were used, and revoke downstream OAuth sessions (e.g. Claude Code OAuth tokens); Add dependency review/scanning to block known malicious crates

### [critical] Malicious npm package hello-world-pkg-value-value-p — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-hello-world-pkg-value-value-p-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-09
GitHub's malware advisory database flagged the npm package hello-world-pkg-value-value-p as embedded malicious code (CWE-506), published 2026-11-09. Every version (>= 0) is affected and no patched version exists, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with attacker access to secrets and keys and no guarantee that removing the package removes all malicious software. The package sees roughly 2,740 downloads per month, so some real-world exposure is likely. There is no fix; remediation is removal of the package plus full incident response on affected machines.
Do: Remove hello-world-pkg-value-value-p from all projects and lockfiles and block it in your registry/proxy; Treat affected machines as fully compromised: rotate all secrets, keys, tokens and credentials stored on them, from a clean machine; Rebuild affected systems from trusted images and audit for persistence and additional malware; Audit CI/CD and dependency caches for the package and review recent builds for exfiltration

### [critical] seolibs-package (npm): malicious package compromises any machine where it is installed; no patched version exists
https://helix.ml/threat-watch/i/seolibs-package-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-patched-version-exists · Supply chain · no-fix-needed · since 2026-11-09
GitHub's malware advisory database published GHSA-87pq-f724-32pv on 2026-11-09 flagging the npm package seolibs-package as embedded malicious code (CWE-506). All published versions (>= 0) are affected and no patched version exists, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be treated as fully compromised, with attackers potentially having full control and access to secrets and keys. The package sees roughly 67 downloads per month, so exposure is limited but real. Removal of the package alone is not guaranteed to remove all malicious software it deployed. There is no fix; remediation is incident response: purge the package, rotate credentials, and rebuild affected machines.
Do: Immediately check lockfiles and node_modules for seolibs-package and remove it from all projects and CI; Treat any machine where it was installed as fully compromised: rotate all secrets, keys, and tokens stored there from a clean machine; Rebuild/reimage affected machines and CI runners rather than trusting cleanup; Audit npm install logs and dependency history to determine when the package was introduced and what it may have accessed; Block the package name in internal registries/proxies to prevent reinstalls

### [critical] npm malware: kafbail — malicious package versions 2.0.12–2.0.14 fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/npm-malware-kafbail-malicious-package-versions-2-0-12-2-0-14-fully-compromise-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-09
GitHub's advisory database published a malware advisory (GHSA-r9ff-73cq-qq8f) for the npm package kafbail, flagging versions 2.0.12, 2.0.13 and 2.0.14 as containing embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched versions exist; the advisory recommends removal of the package and immediate rotation of all secrets and keys from a clean machine. Affected users are any developers or CI systems that installed these versions of kafbail from npm. Published and reviewed 2026-11-09.
Do: Remove kafbail from all machines and CI environments; Rotate all secrets, keys, and credentials stored on affected machines, using a clean computer; Rebuild/reimage compromised machines; do not assume removal of the package removes all malicious software; Audit npm lockfiles and dependency trees for kafbail versions 2.0.12–2.0.14; Review logs for signs of exfiltration or unauthorized access

### [critical] npm malware: internal-company-module-test-1337 — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/npm-malware-internal-company-module-test-1337-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-09
GitHub Advisory Database published GHSA-c9wj-j3q9-23f2 on 2026-11-09 flagging the npm package internal-company-module-test-1337 as malware (CWE-506, Embedded Malicious Code). All versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. The package sees roughly 2,085 downloads per month. Any developer or CI environment that installed it should treat secrets and keys as stolen and rotate them from a clean machine. There is no fix; remediation is removal plus credential rotation and system rebuild.
Do: Rotate all secrets, keys, and credentials stored on machines where the package was installed, using a clean computer; Remove the package and rebuild/reimage affected machines from trusted images; Audit install logs and CI pipelines for the package and block it in dependency firewalls/allowlists; Review for signs of persistence or exfiltration on affected hosts

### [critical] 2026-11-parseyaml campaign: extrahtml & parseyaml (PyPI) — malicious YAML-loader dependency downloads and executes remote code
https://helix.ml/threat-watch/i/2026-11-parseyaml-campaign-extrahtml-parseyaml-pypi-malicious-yaml-loader-dependency-downloads-and-executes-remote-code · Supply chain · no-fix-needed · since 2026-11-09
On 2026-11-09 GitHub's Advisory Database and OpenSSF's malicious-packages repo published advisories for two PyPI packages, extrahtml (0.1.0–0.1.2) and parseyaml (1.2.0), tied to the '2026-11-parseyaml' campaign. The packages embed a dependency posing as a YAML loader that includes a special loader capable of executing code from a provided file, enabling download and execution of a remote malicious script. Analysts noted the payload was only a stub at analysis time, but the intent is clearly malicious (infostealer-class). No patched versions exist; the packages should be treated as malware and removed. Anyone who installed these packages is at risk of remote code execution on their build or runtime environments.
Do: Immediately uninstall and purge extrahtml and parseyaml from all environments, lockfiles, and caches; Audit systems where these packages ran for signs of downloaded/ executed scripts, persistence, and credential theft; rotate secrets and tokens; Check dependency trees and CI pipelines for the packages and block them via repository allowlists or proxy policies; Review PyPI install logs to determine exposure window and scope; Prefer vetted YAML libraries (e.g., PyYAML with safe_load) and verify package provenance before installing

### [critical] bundyfed PyPI malware: malicious setup.py downloads infostealer during install
https://helix.ml/threat-watch/i/bundyfed-pypi-malware-malicious-setup-py-downloads-infostealer-during-install · Supply chain · no-fix-needed · since 2026-11-09
The PyPI package bundyfed (versions 1.0.0 and 1.0.1) is malicious: its setup.py overrides the install command to download and execute a remote executable containing an infostealer, compromising any developer or CI environment that installs the package. GitHub Advisory Database entry GHSA-w2rp-hfm9-fh77 (campaign 2026-11-bundyfed, CWE-506) was published 2026-11-09 with credit to OpenSSF's malicious-packages project and kam193's bad-packages analysis. There are no patched versions — the package is malware and should be removed, not upgraded. Anyone who installed bundyfed should assume credential and data theft from the affected machine.
Do: Remove bundyfed from all environments and dependency trees; do not install or pin it; Treat any machine or CI runner that installed bundyfed as compromised: rotate stored credentials, tokens, and keys; Review browser-saved passwords, SSH keys, and cloud credentials for exfiltration; check for the downloaded executable; Block the package name in internal PyPI mirrors/proxies and alert developers who may have installed it; Audit install logs to determine exposure window and scope

### [medium] Malicious PyPI package lookuptest11 exfiltrates host info on install/import
https://helix.ml/threat-watch/i/malicious-pypi-package-lookuptest11-exfiltrates-host-info-on-install-import · Supply chain · no-fix-needed · since 2026-11-08
GitHub Advisory Database (GHSA-c9jc-238p-3h46, published 2026-11-08) flags the PyPI package lookuptest11 as malicious. The package overrides the install command in setup.py so malicious code runs during pip install, and importing the module also exfiltrates basic host information such as IP address and username; the package has no other purpose. It is categorized as PROBABLY_PENTEST under the GENERIC-standard-pypi-install-pentest campaign, with limited risk. Only version 0.0.1 is affected and no fixed version exists — the package is malware and will not be patched. Anyone who installed lookuptest11 0.0.1 may have leaked basic system details to the attacker.
Do: Check environments and CI for installs of lookuptest11 and remove it; If installed, treat host IP/username as exposed and rotate any credentials that could be inferred; Audit pip install logs and setup.py execution history for the package; Block/flag lookuptest11 in internal PyPI mirrors and dependency scanners; Prefer hash-pinned, scanned dependencies for install-time code execution risk

### [critical] 2026-11-chromacli campaign: chromacli / supercolor-tui / rainbowcolors (PyPI) — typosquatted color libs drop Solace infostealer on Windows
https://helix.ml/threat-watch/i/2026-11-chromacli-campaign-chromacli-supercolor-tui-rainbowcolors-pypi-typosquatted-color-libs-drop-solace-infostealer-o · Supply chain · no-fix-needed · since 2026-11-08
Three PyPI packages posing as terminal-color libraries — chromacli (0.1.0–0.1.4), supercolor-tui (0.1.0–0.1.4) and rainbowcolors (0.1.0) — were published to the GitHub Advisory Database on 2026-11-08 as part of the '2026-11-chromacli' malware campaign. On Windows, calling any exported Color method (print/paint/__call__) triggers a hidden code path that uses PowerShell (-NoProfile -ExecutionPolicy Bypass, CREATE_NO_WINDOW) to add Microsoft Defender exclusions for %TEMP%\SolaceRuntime and solace.exe, then downloads an unsigned solace.exe from an anonymous gofile.io share and launches it detached via subprocess.Popen. The payload is an infostealer; behavior is entirely unrelated to the packages' stated purpose. No patched versions exist — all published releases are malicious.
Do: Immediately remove chromacli, supercolor-tui and rainbowcolors from all environments and dependency files; do not use any version; If installed on Windows, assume compromise: hunt for %TEMP%\SolaceRuntime\solace.exe, Defender exclusion entries for SolaceRuntime/solace.exe, and gofile.io download activity; Rotate credentials, tokens and browser-stored secrets on affected Windows machines; reimage if infostealer execution is confirmed; Check CI/CD and developer Windows hosts for these packages in dependency caches and lockfiles; Pin dependencies and verify packages against advisory databases before install

### [critical] DNS-beacon typosquat/dependency-confusion malware: blender-headless, expect-tests, infra-libs (PyPI) exfiltrate hostnames
https://helix.ml/threat-watch/i/dns-beacon-typosquat-dependency-confusion-malware-blender-headless-expect-tests-infra-libs-pypi-exfiltrate-hostnames · Supply chain · no-fix-needed · since 2026-11-08
Three malicious PyPI packages — blender-headless (9.99.9), expect-tests (99.99.99) and infra-libs (99.99.99) — were identified on 2026-11-08 via OpenSSF/amazon-inspector analysis and published as GitHub malware advisories. Each ships a setup.py and a gcp_log_poc/__init__.py module that read the installer's hostname via platform.node(), encode it into a DNS label (install- or import-prefixed), and resolve it under attacker-controlled zones finaltests99.dssldrf.net or testa213022.dssldrf.net via socket.getaddrinfo. This exfiltrates hostnames and install/import events over DNS, bypassing typical HTTP egress controls, at pip install time and on every import. The packages have no legitimate functionality matching their names; high version numbers and name/module mismatches indicate dependency-confusion lures. No patched versions exist; removal from PyPI is the only mitigation.
Do: Search environments and dependency lockfiles for blender-headless, expect-tests and infra-libs; remove any installations immediately; Rotate credentials and investigate hosts where these packages were installed or imported, treating hostnames as leaked; Block DNS resolution of dssldrf.net and its subdomains at resolvers/firewalls; Audit pip install logs and CI builds for DNS queries to the identified domains; Harden dependency resolution with private indexes, allowlists and hash pinning to defeat dependency-confusion

### [medium] RubyGems install-time code execution: four data-exfiltrating gems run code on gem install and even gem list
https://helix.ml/threat-watch/i/rubygems-install-time-code-execution-four-data-exfiltrating-gems-run-code-on-gem-install-and-even-gem-list · Supply chain · partial · since 2026-11-05
Aikido Security reports that RubyGems runs code from a gem at two points a user would not expect: the build files a gem lists under its native extensions run during gem install, and a rubygems_plugin.rb file is loaded on every gem command, including gem list and gem -v, for as long as the gem stays installed. Four gems published on RubyGems between 2013 and 2015 abuse this. xmastree and ancient-city-ruby send the installer's username, hacky uploads a silent macOS screenshot, and et_phone_home sends a GET beacon to a raw IP address. On 2026-11-07 the registry still listed all four, none yanked, with about 25,600 lifetime downloads between them. Laptops and CI runners that run gem install or bundle install are exposed, and installing one of these gems is enough to trigger its install-time payload; the xmastree 0.0.1 build runs only when rake is run inside its directory. Stable RubyGems and Bundler 4.0.x have no switch to disable either path. The 4.1.0.beta3 prerelease adds opt-out flags, and the behaviour stays on unless they are passed. Aikido reported the execution paths and the four gems to RubyGems in late October 2026; no RubyGems statement or takedown was found.
Fixed: RubyGems/Bundler 4.1.0.beta3 (opt-out settings)
Do: Search lockfiles and installed gems for xmastree, ancient-city-ruby, hacky, et_phone_home (repeat per Ruby version); if found, stop spawned processes, gem uninstall --all --executables, remove from Gemfile, and assess exfiltration exposure; List RubyGems plugin directories (ruby -e 'Gem.path.each { |p| puts Gem.plugindir(p) }') and uninstall unneeded plugins; Upgrade to RubyGems/Bundler 4.1.0.beta3 and disable install-time execution: --no-build-extension --no-install-plugin for gem install; bundle config set --global no_build_extension true and no_install_plugin true; set BUNDLE_NO_BUILD_EXTENSION=true and BUNDLE_NO_INSTALL_PLUGIN=true in CI; Note that skipped-extension gems won't load (bundle exec fails); only disable extension builds in install-only CI steps unless all gems have precompiled builds

### [critical] @htooayelwinict/travis234 npm malware: full machine compromise for users of version 3.3.2 (no CVE)
https://helix.ml/threat-watch/i/htooayelwinict-travis234-npm-malware-full-machine-compromise-for-users-of-version-3-3-2-no-cve · Supply chain · no-fix-needed · since 2026-11-08
GitHub's malware advisory database flagged the npm package @htooayelwinict/travis234 version 3.3.2 as containing embedded malicious code (CWE-506). GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying the malware grants attackers full control of the machine, enabling theft of secrets, keys and credentials. No patched version exists and the package should simply be removed, though removal cannot guarantee the malicious software is fully eradicated. The package sees roughly 1,369 downloads per month, so exposure is limited but real. Developers who installed version 3.3.2 should treat all credentials on affected machines as stolen and rotate them from a clean computer.
Do: Stop using and uninstall @htooayelwinict/travis234 3.3.2 immediately; Consider any machine that ran the package fully compromised; rebuild or thoroughly clean it; Rotate all secrets, keys, tokens and credentials stored on affected machines, from a different clean computer; Audit for persistence mechanisms and residual malware, since removal of the package may not remove all malicious software; Check dependency trees and CI systems for the package and block it

### [critical] 2026-11-old-pyuserfox campaign: pyuserox, pyuserfox, twitch-stream-py PyPI packages download and execute remote malicious code on import
https://helix.ml/threat-watch/i/2026-11-old-pyuserfox-campaign-pyuserox-pyuserfox-twitch-stream-py-pypi-packages-download-and-execute-remote-malicious-c · Supply chain · no-fix-needed · since 2026-11-08
OpenSSF and GitHub Advisory Database published malware advisories on 2026-11-08 for three malicious PyPI packages tied to campaigns originally discovered by Threx-code. pyuserox 0.0.2 and pyuserfox 0.0.2 silently download and execute a remote malicious script during import. twitch-stream-py, a clone of a legitimate package with injected code, uses obfuscation and hides the malicious action in library usage across versions 1.0.2rc0 through 1.1.2. The campaigns are categorized as MALICIOUS (infostealer-like intent). During analysis the remote payloads were no longer accessible, so full impact is unknown. No patched versions exist; the packages should be treated as compromised and removed.
Do: Immediately uninstall pyuserox, pyuserfox, and twitch-stream-py from all environments and block them in dependency allowlists and CI; Audit lockfiles and dependency trees for these packages and any versions of twitch-stream-py; If installed, treat hosts as compromised: rotate credentials, secrets, and tokens accessible to those environments, and review for infostealer artifacts; Rebuild affected environments from trusted images and re-verify dependencies against OpenSSF malicious-packages data

### [critical] PyPI packages qzc690382-385: install-time backdoor shells and host recon via Xinference API
https://helix.ml/threat-watch/i/pypi-typosquat-backdoor-trio-qzc690382-383-385-install-time-rce-shell-and-host-recon-via-xinference-abuse · Supply chain · no-fix-needed · since 2026-11-07
Four PyPI packages with random-looking names (qzc690382, qzc690383, qzc690384, qzc690385) were flagged on 2026-11-07 by GitHub advisories, OSV and Amazon Inspector. They contain no real functionality; the payload runs from setup.py during pip install. qzc690382 writes a Python HTTP server to /tmp/.kxs, starts it detached, binds 0.0.0.0 on ports 9998, 9999, 8089, 8099 and 8899, and executes shell commands passed in a GET parameter. qzc690385 does the same from /tmp/.zqx on ports 9998, 9999, 8089, 8099 and 8777, and also uses the local Xinference API at 127.0.0.1:9997 as a command channel: it reads model registrations with an xcmd0 name prefix, runs the decoded command, and writes output back as new registrations. qzc690383 and qzc690384 fingerprint the host (user, hostname, kernel, GPU, process metadata, public IP) and send it out as model names on the same local Xinference API; qzc690384 is also described as pulling later stages from localhost. The sources describe Xinference as a local server the malware talks to; nothing we read says these packages install, modify or compromise Xinference itself. qzc690385 has fourteen releases (1.0.0 through 1.1.3). PyPI now marks the projects as quarantined. No patched versions exist: remove the packages, check the listed ports and temp files on any host that installed them, and review Xinference model registrations for xcmd0 names.
Do: Check whether qzc690382, qzc690383, qzc690384 or qzc690385 (1.0.0/1.0.1) appear in pip logs, lockfiles or site-packages; treat any install as compromise; On affected hosts, kill processes running /tmp/.kxs or /tmp/.zqx, delete those files and /tmp/.kxq, and audit listening ports 9998, 9999, 8089, 8099, 8899, 8777; Review Xinference model registrations for suspicious flexible-launcher entries used as a data-exfil/RCE channel; Hunt for commands executed via the backdoor's shell endpoint and downloaded second-stage payloads; rotate credentials used on installing accounts; Block these package names in internal PyPI mirrors/proxies and require hash-pinned dependencies

### [critical] gcp-log-poc PyPI malware: import-time exfiltration of environment variables (no CVE)
https://helix.ml/threat-watch/i/gcp-log-poc-pypi-malware-import-time-exfiltration-of-environment-variables-no-cve · Supply chain · no-fix-needed · since 2026-11-07
OpenSSF and GitHub Advisory Database report the PyPI package gcp-log-poc as malicious code (GHSA-3qwc-2vj2-6vc8, CWE-506). On import, the package exfiltrates environment information, including potentially sensitive environment variables, plus basic system data such as IP address and username. Versions 0.0.1, 0.0.2 and 0.0.3 are affected; no patched versions exist and the package should be treated as malware. Anyone who installed or imported the package is affected and should assume environment secrets were stolen. Remediation is removal of the package and rotation of any credentials exposed via environment variables.
Do: Remove gcp-log-poc from all environments and block it in dependency policies; Rotate any credentials, tokens or API keys that were present in environment variables on affected machines; Audit logs and network egress for signs of exfiltration from affected hosts; Scan dependency lockfiles and CI caches for the package and rebuild from clean images

### [critical] GENERIC-standard-pypi-install-pentest: malicious PyPI packages genblaze-atlascloud, genblaze-fal, pulumi-doppler exfiltrate host info on install
https://helix.ml/threat-watch/i/generic-standard-pypi-install-pentest-malicious-pypi-packages-genblaze-atlascloud-genblaze-fal-pulumi-doppler-exfiltrate · Supply chain · no-fix-needed · since 2026-11-07
On 2026-11-07 the GitHub Advisory Database published malware advisories for three PyPI packages: genblaze-atlascloud 0.1.0, genblaze-fal 0.1.0, and pulumi-doppler 0.0.0/1.0.0. Each package overrides the install command in setup.py so that malicious code runs during pip install (or on module import), exfiltrating basic host information such as IP address and username; the packages have no other purpose. Classified under the GENERIC-standard-pypi-install-pentest campaign as PROBABLY_PENTEST with limited risk, but flagged critical with CWE-506 (embedded malicious code). No patched versions exist; the only mitigation is removal. Anyone who installed or imported these packages is affected.
Do: Search environments and lockfiles for genblaze-atlascloud, genblaze-fal, and pulumi-doppler and uninstall any instances; If installed or imported, treat the host as compromised: rotate credentials, review network logs for exfiltration, and rebuild affected systems; Block these package names in PyPI mirrors, proxies, and CI dependency scanning; Audit pip install workflows to avoid executing setup.py code from untrusted packages (e.g. use --only-binary or vetted indexes)

### [critical] Malware in dsh-notify-focus npm package — full machine compromise for users of versions 0.5.0, 0.7.0, 0.7.1
https://helix.ml/threat-watch/i/malware-in-dsh-notify-focus-npm-package-full-machine-compromise-for-users-of-versions-0-5-0-0-7-0-0-7-1 · Supply chain · no-fix-needed · since 2026-11-07
GitHub's advisory database published a malware advisory (GHSA-xf64-9h92-4jxq) for the npm package dsh-notify-focus, flagging versions 0.5.0, 0.7.0 and 0.7.1 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the machine. No patched versions exist and no source code is known; the package (~564 monthly downloads, 1 GitHub star) cannot be safely remediated by upgrade. Users should treat all secrets and keys on affected machines as stolen and rotate them from a clean computer, remove the package, and rebuild/reimage affected systems since removal may not eliminate all malicious software.
Do: Rotate all secrets, keys, tokens and credentials stored on machines where dsh-notify-focus was installed, using a different, uncompromised computer; Remove the package and rebuild or reimage affected machines, as removal may not eliminate all malicious software; Audit systems and CI environments for the package and review logs for signs of compromise or exfiltration; Block/avoid installing dsh-notify-focus and pin dependencies to prevent reintroduction

### [critical] 2026-11-reqnest: Malicious PyPI packages reqnest, reqnests, fhqiouhq, ajfhiuqhfqgwerhuqnfqh exfiltrate Telegram files on import
https://helix.ml/threat-watch/i/2026-11-reqnest-malicious-pypi-packages-reqnest-reqnests-fhqiouhq-ajfhiuqhfqgwerhuqnfqh-exfiltrate-telegram-files-on-imp · Supply chain · no-fix-needed · since 2026-11-07
On 2026-11-07 GitHub's advisory database published four malware advisories for PyPI packages tied to the '2026-11-reqnest' campaign: reqnest (0.1.0), reqnests (0.1.0 and 0.1.1), fhqiouhq (0.1.0), and ajfhiuqhfqgwerhuqnfqh (0.1.0). All execute on import and exfiltrate sensitive Telegram files (session data) to a remote location, classified as infostealer malware with files-exfiltration and typosquatting behavior. Anyone who pip-installed any of these packages and imported them on a machine with Telegram installed is affected; credentials and session files may already be in attacker hands. There are no patched versions — the packages are simply malicious and should be removed. Discovered and reported via kam193's bad-packages project and OpenSSF malicious-packages.
Do: Immediately uninstall reqnest, reqnests, fhqiouhq and ajfhiuqhfqgwerhuqnfqh from all environments and purge them from requirements/lockfiles and CI caches; Assume compromise if any was imported: log out all Telegram sessions, revoke them, and re-authenticate; delete tdata/session files and scan for persistence; Rotate any credentials, API keys or secrets accessible from affected machines and review access logs for exfiltration; Audit pip install history and dependency resolution for typosquatting; pin dependencies and verify package names against official sources

### [critical] npm: malicious kampodine, modelsdesk, tailwind-animationfound and @cherrydotfun/miniapp-sdk releases
https://helix.ml/threat-watch/i/npm-malware-wave-kampodine-modelsdesk-tailwind-animationfound-cherrydotfun-miniapp-sdk-malicious-packages-fully-compromi · Supply chain · no-fix-needed · since 2026-11-05
Between 2026-11-05 and 2026-11-06 four npm packages published malicious releases, and GitHub issued malware advisories for them on 2026-11-06: kampodine 0.8.0 (published 2026-11-05 18:29 UTC), modelsdesk 0.4.2 (2026-11-05 20:59 UTC), @cherrydotfun/miniapp-sdk 0.1.22 and 0.1.23 (2026-11-06 20:46 and 21:36 UTC), and tailwind-animationfound, whose registry entry now shows an npm security-holding placeholder. Each advisory rates the package critical and says that any machine that installed or ran it should be treated as fully compromised, so secrets should be rotated from a clean machine and the host rebuilt, since removing the package may not remove what it dropped. The sources read do not describe the payload. npm downloads for 2026-10-08 to 2026-11-06 were 957 for kampodine, 1,043 for modelsdesk, 281 for tailwind-animationfound and 4,055 for @cherrydotfun/miniapp-sdk; the SDK figure also includes its earlier legitimate versions. The two kampodine-family packages share one npm maintainer and GitHub repositories created weeks before the malicious releases. The SDK's malicious versions came from a commit that added an automated publish workflow about half an hour earlier, so the release path itself needs checking. Remove the packages, pin dependencies, rotate secrets from a clean machine, and rebuild affected hosts and CI runners.
Do: Immediately uninstall the affected packages (kampodine 0.8.0, modelsdesk 0.4.2, tailwind-animationfound any version, @cherrydotfun/miniapp-sdk 0.1.22) and block them in dependency policies; Rotate all secrets, API keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected hosts and CI runners; do not assume removal of the package removes the malware; Audit dependency lockfiles and install logs for these packages and review for signs of compromise; Add these package names to deny-lists and enable npm/GitHub malware advisory scanning in CI

### [critical] 2026-11-protecteda / 2026-11-filipt: Malicious PyPI packages protecteda, ln9qw38745g, zyto ship infostealer and RAT payloads
https://helix.ml/threat-watch/i/2026-11-protecteda-2026-11-filipt-malicious-pypi-packages-protecteda-ln9qw38745g-zyto-ship-infostealer-and-rat-payloads · Supply chain · no-fix-needed · since 2026-11-04
Three malicious PyPI packages were published to the GitHub Advisory Database on 2026-11-04 as part of two related campaigns. protecteda 0.1.0 runs an embedded executable identified as an infostealer when started as a module. ln9qw38745g 0.1.0/0.1.1 and zyto 0.2.0-0.2.3 (campaign 2026-11-filipt) ship embedded executables flagged by AV vendors and override the install command in setup.py to execute malicious code during installation; the campaign is linked to a prior package that swapped a benign executable for a malicious RAT after a few releases. No patched versions exist — the packages are outright malware and should be removed. Anyone who installed any of these packages is at risk of credential and data theft or RAT compromise.
Do: Check environments and lockfiles for protecteda, ln9qw38745g and zyto and remove them immediately; If installed, treat all credentials, tokens and browser data on affected machines as compromised — rotate secrets and reimage if possible; Audit setup.py install hooks and CI builds for execution of embedded executables; Block these packages in internal registries/proxies and monitor for related campaign names

### [critical] Malicious npm package automic-style-engine — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-automic-style-engine-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-06
GitHub's advisory database published GHSA-96vr-mq8q-pxcc on 2026-11-06 flagging the npm package automic-style-engine as embedded malware (CWE-506). All versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; secrets and keys stored on affected machines must be rotated. Removal of the package does not guarantee removal of all malicious software it installed. Anyone who installed the package is affected; exploitation is inherent to installation.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine; Remove the package and rebuild/reimage affected systems from trusted sources; Audit systems for persistence mechanisms and other malicious software left behind; Check dependency trees and lockfiles for automic-style-engine and block it in CI/CD and registries

### [critical] strutil-core Ruby gem 1.0.1: Shai-Hulud-descendant worm steals credentials, poisons AI tools
https://helix.ml/threat-watch/i/shai-hulud-descendant-miasma-worm-strutil-core-ruby-gem-malicious-1-0-1-steals-credentials-poisons-ai-tools-wipes-files · Supply chain · no-fix-needed · since 2026-11-01
Socket's Threat Research Team found that strutil-core 1.0.1 on RubyGems, published from the account jamnajiea about two hours after a clean 1.0.0, is malicious. A native extension downloads the Bun runtime and runs a 5.48 MB credential-stealing payload during gem install or bundle install. Socket describes the payload as a new build of the testmetest worm in the Miasma family, which grew out of the public Shai-Hulud toolkit; Socket says shared code does not prove the same operator is behind every build. The payload takes cloud, CI, package-registry, SSH, GitHub and GitLab, AI-coding-tool and wallet credentials and sends them to paleasbest[.]top. It installs a Python backdoor that acts on signed GitHub commit messages, writes an MCP server and session hooks into AI-tool configuration, and deletes the user's home directory if a stolen GitHub token returns HTTP 401 or 403, so revoking a stolen token can trigger the wiper. Its propagation code covers RubyGems, npm, PyPI, GitHub, GitLab and SSH, but Socket has not confirmed any downstream package or victim, and no public projects depend on the gem. RubyGems removed both versions about five hours after the malicious release, and no fixed version exists. Anyone who installed 1.0.1 should rotate the listed credentials and remove persistence before revoking any GitHub token.
Do: Audit installed gems and CI logs for strutil-core 1.0.0/1.0.1 and for ext/<gem>/index.js or extconf.rb anomalies in any gem; Rotate all credentials the payload targets: cloud, CI, package registry (RubyGems, npm, PyPI), SSH keys, GitHub/GitLab tokens, AI coding tool and wallet secrets; Check for persistence: Python backdoors, MCP server entries, session hooks and modified agent instruction files in local configs and repositories; Block the exfiltration domain paleasbest[.]top and monitor for connections to it; Review GitHub audit logs for unexpected commits or signed commit-message activity indicating the backdoor channel; Pin and verify gem dependencies; avoid installing gems with native extensions that download external runtimes

### [critical] Malicious npm package @needsaudit/n — full system compromise of any machine where installed (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-needsaudit-n-full-system-compromise-of-any-machine-where-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-8592-4qmq-q59w) for the npm package @needsaudit/n, flagged as embedded malicious code (CWE-506) with all versions (>=0) affected and no patched versions. Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; secrets and keys on affected machines must be treated as stolen. The package sees roughly 256 downloads per month. Removal of the package alone does not guarantee removal of malicious software it may have installed. There is no fix — the only remediation is removal plus full incident response on affected hosts.
Do: Immediately remove @needsaudit/n from all projects and machines; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage affected machines; do not assume package removal removes the malware; Audit for persistence mechanisms and network connections to attacker infrastructure; Block the package in npm/CI dependency allowlists and scan dependency trees for it

### [critical] Malware in @needsaudit/nexport npm package — full host compromise, rotate all secrets
https://helix.ml/threat-watch/i/malware-in-needsaudit-nexport-npm-package-full-host-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-v24v-jw84-cp3h) for the npm package @needsaudit/nexport, flagged as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists, so the package cannot be safely used at any version. The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of the malicious software. All secrets and keys on affected machines should be treated as stolen. Reach appears limited (~267 downloads/month), but any installation warrants full incident response including secret rotation and host rebuild.
Do: Treat any machine with @needsaudit/nexport installed as fully compromised; rotate all secrets and keys from a clean machine immediately; Remove the package and rebuild/reimage affected hosts rather than trusting cleanup; Audit dependency trees and CI/CD for the package and block it in registries/proxies; Review logs for signs of exfiltration or follow-on attacker activity

### [critical] Malicious npm package @noinheritdoc/n — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-noinheritdoc-n-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub's Advisory Database published GHSA-8qcq-2278-9c4c on 2026-11-06 flagging the npm package @noinheritdoc/n as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. Any developer or CI environment that installed the package is affected. There is no fix — remediation is removal, secret rotation from a clean machine, and system rebuild.
Do: Immediately stop using/remove @noinheritdoc/n from all projects and CI pipelines; Rotate all secrets, keys, and credentials stored on affected machines, from a different clean computer; Rebuild or reimage affected machines; do not assume package removal removes the malware; Audit systems for persistence mechanisms and unauthorized access; Block the package in npm registries and dependency scanning

### [critical] Malicious npm package @site-cms/ssr — full system compromise for anyone who installed it (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-site-cms-ssr-full-system-compromise-for-anyone-who-installed-it-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub's malware advisory database has flagged the npm package @site-cms/ssr as embedded malicious code (CWE-506), published 2026-11-06. All versions (>= 0) are affected and no patched version exists; the package has no known source code repository. Any machine with the package installed or running must be considered fully compromised, with control potentially handed to an outside entity. Secrets and keys stored on affected machines are at risk of theft. The advisory instructs removal of the package but warns removal may not eliminate all malicious software planted during installation. Any developer, CI system, or deployment that pulled this package from npm is affected.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine where the package was installed, using a clean machine; Remove @site-cms/ssr from all projects, lockfiles and CI pipelines and audit for persistence mechanisms; Rebuild/reimage affected machines and CI runners; do not trust them after removal alone; Audit npm audit logs and dependency trees for other packages from the same publisher; Review access and network logs for signs of exfiltration or attacker activity

### [critical] Malicious npm package @ts-expect-error/n — full compromise of any machine where installed (none)
https://helix.ml/threat-watch/i/malicious-npm-package-ts-expect-error-n-full-compromise-of-any-machine-where-installed-none · Supply chain · no-fix-needed · since 2026-11-06
GitHub's malware advisory database published GHSA-pc8x-j8xp-chwx on 2026-11-06 flagging the npm package @ts-expect-error/n as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removing the package does not guarantee removal of all malicious software. All secrets and keys on affected machines should be rotated. Any developer or CI environment that installed the package is affected; no fixed version is available, so remediation is removal plus host forensics and credential rotation.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine where the package was installed, using a clean machine; Remove the package from all projects, lockfiles, and CI caches; Rebuild or wipe affected machines and containers; treat hosts as compromised; Audit npm dependency trees and lockfiles for the package and similar typosquats; Review logs and network traffic for signs of attacker access or exfiltration

### [critical] @sideeffects/n npm package is malware — full machine compromise, no safe version exists
https://helix.ml/threat-watch/i/sideeffects-n-npm-package-is-malware-full-machine-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-06
GitHub's malware advisory database has flagged the npm package @sideeffects/n as malicious (GHSA-3r7f-mx9r-h22h, CWE-506 embedded malicious code). Every published version (>= 0) is affected and there are no patched versions, so any installation of the package at any version should be treated as a compromise. Per the advisory, any computer where the package was installed or run must be considered fully controlled by an outside entity, meaning attackers may have exfiltrated secrets and keys and deployed additional persistent malware that removal of the package will not eliminate. All developers and CI systems that installed the package are potentially affected. There is no fix; remediation is removal plus credential rotation and host rebuild.
Do: Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean computer; Remove the package and rebuild/reimage affected machines from trusted images; do not trust removal alone; Audit affected systems for persistence and additional malicious software; Check npm lockfiles and CI caches for any dependency on @sideeffects/n and block it

### [critical] wisdomtreetest (npm): malicious package compromises any machine where it is installed (no CVE)
https://helix.ml/threat-watch/i/wisdomtreetest-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-xmwx-vmwg-j2pp) on 2026-11-06 for the npm package wisdomtreetest, classifying it as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; secrets and keys stored on affected machines are at risk. Removal of the package does not guarantee removal of all malicious software it may have installed. Anyone who installed wisdomtreetest from npm is affected. There is no fix; remediation requires removal, forensic cleanup, and credential rotation from a clean machine.
Do: Stop using and uninstall wisdomtreetest immediately; Rotate all secrets, keys, and credentials stored on affected machines, from a different clean computer; Reimage or rebuild affected machines; do not assume removal of the package removes all malware; Audit systems and CI for signs of compromise and review npm lockfiles for the package; Block the package in dependency policies and check for it across repositories

### [critical] Malicious npm package tw-motion-css — full system compromise on install; no safe version exists
https://helix.ml/threat-watch/i/malicious-npm-package-tw-motion-css-full-system-compromise-on-install-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-chcp-mhw3-w5hq) on 2026-11-06 for the npm package tw-motion-css. All versions (>= 0) are classified as malicious with no patched version available; the package embeds malicious code (CWE-506) and is considered to grant attackers full control of any machine where it is installed or running. Any computer with the package should be treated as fully compromised, with secrets and keys at risk of exfiltration. Because attackers may have established persistent outside access, removing the package does not guarantee removal of all malicious software. Affected users are any developers or CI systems that installed tw-motion-css; the only remediation is removal plus full credential rotation and host forensics/rebuild.
Do: Immediately stop using and remove tw-motion-css from all projects, lockfiles and CI caches; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Rebuild or thoroughly forensically clean affected hosts; assume persistence; Audit npm dependency trees and CI logs for other installs of the package; Review access logs and network egress for signs of attacker activity

### [critical] Malicious npm package monopw — full system compromise for anyone installing it (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-monopw-full-system-compromise-for-anyone-installing-it-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub's malware advisory database published GHSA-3h2m-23f2-wjcx on 2026-11-06 flagging the npm package monopw as embedded malicious code (CWE-506). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. All versions (>= 0) are affected and no patched version exists; the package has no known source code repository. Downloads are low (~54/month), limiting reach, but any installer is exposed to full machine compromise, secret theft and persistent malware that removal of the package may not eliminate. The only remediation is removal plus rotation of all secrets and keys from a clean machine.
Do: Remove the monopw package from all machines and CI environments immediately; Rotate all secrets, keys, tokens and credentials stored on affected machines, from a different clean computer; Reimage or rebuild affected machines; do not assume package removal removed the malware; Audit install logs and dependency trees for monopw usage and check for follow-on compromise; Block/flag the package in internal registries and dependency scanning

### [critical] monobomber (npm): malicious package compromises any machine where installed (no CVE)
https://helix.ml/threat-watch/i/monobomber-npm-malicious-package-compromises-any-machine-where-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub's malware advisory database published GHSA-rxx3-78r3-w9qw on 2026-11-06 flagging the npm package 'monobomber' as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with control potentially ceded to an outside entity, and removal of the package does not guarantee removal of all malicious software. Any developer, CI system, or end user who installed monobomber is affected. There is no fix; remediation consists of removing the package, rotating all secrets and keys from a clean machine, and rebuilding compromised hosts.
Do: Treat any machine with monobomber installed as fully compromised; rotate all secrets and keys immediately from a different, clean computer; Remove the package and rebuild/reimage affected hosts and CI runners rather than trusting cleanup; Audit dependency locks and install logs for monobomber and block it in registries/proxies; Review access logs and credentials (npm tokens, cloud keys, SSH keys) for signs of exfiltration

### [critical] Malicious npm package evmos-contracts — full host compromise, no safe version exists
https://helix.ml/threat-watch/i/malicious-npm-package-evmos-contracts-full-host-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-06
GitHub published advisory GHSA-ch75-7hv2-w5hw on 2026-11-06 flagging the npm package evmos-contracts as malware (CWE-506, Embedded Malicious Code). Every published version (>= 0) is affected and no patched version exists, so any installation is considered a compromise. The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and that removing the package does not guarantee removal of all malicious software. Secrets and keys stored on affected machines are at risk. Exploitation details and in-the-wild spread are not stated. Remediation is incident response, not upgrading: remove the package and rotate all credentials from a clean machine.
Do: Treat any machine where evmos-contracts was installed or run as fully compromised; isolate and forensically review it; Rotate all secrets, keys, tokens and credentials stored on affected machines, from a clean computer; Remove the package and rebuild affected systems from trusted images; do not assume removal fully cleans the host; Audit dependency lockfiles and CI pipelines for evmos-contracts and block its installation; Review for signs of unauthorized access or persistence and monitor related accounts

### [critical] Malicious npm package securedrop-app — full system compromise; rotate all secrets and keys (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-securedrop-app-full-system-compromise-rotate-all-secrets-and-keys-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-pwrj-3qm6-97g6) on 2026-11-06 for the npm package securedrop-app, flagging it as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched versions exist. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially given to an outside entity, and removal of the package does not guarantee removal of all malicious software. The package shows ~18 downloads/month, so reach is limited, but any machine that installed it must be treated as breached. There is no fix; remediation is removal plus full secret rotation and system rebuild.
Do: Immediately stop using and remove securedrop-app from all machines and CI environments; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Rebuild/reimage affected systems; do not assume removal of the package removed the malware; Audit for persistence mechanisms and review logs for signs of external access; Block the package in internal registries and dependency scanning

### [critical] kc-kline-chart (npm): malicious package compromises any machine where it is installed
https://helix.ml/threat-watch/i/kc-kline-chart-npm-malicious-package-compromises-any-machine-where-it-is-installed · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-h4xm-rc72-8jph) for the npm package kc-kline-chart on 2026-11-06. All versions (>= 0) are affected and no patched version exists; the package is classified as malware (CWE-506, embedded malicious code). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. Developers and CI systems that installed kc-kline-chart are affected; secrets and keys on those machines are at risk. There is no fix — the only remediation is removal of the package plus host forensics and credential rotation.
Do: Rotate all secrets, keys, and credentials stored on machines where kc-kline-chart was installed, using a clean computer; Remove the package from all projects, lockfiles, and CI caches and block/audit for it; Rebuild affected machines or containers from trusted images; treat hosts as compromised; Audit logs and network egress for signs of attacker access following installation; Scan dependencies for other typosquatted or malicious packages before reinstalling

### [critical] Malicious npm package arc-contracts — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-arc-contracts-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-qcjv-pgw5-h2f5) for the npm package arc-contracts on 2026-11-06. All versions (>= 0) are affected and no patched version exists; the package is classified as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. Secrets and keys stored on affected machines are at risk. Removal of the package does not guarantee removal of all malicious software planted during installation. No fix is available; the only safe action is removal plus full credential rotation and system rebuild.
Do: Rotate all secrets, keys, and credentials stored on machines where arc-contracts was installed, from a clean machine; Remove the arc-contracts dependency and purge it from lockfiles and caches; Rebuild/reimage affected machines; do not assume removal cleans the system; Audit for persistence, unauthorized access, and exfiltration since installation; Block the package in dependency policies and CI to prevent reinstallation

### [critical] Malicious npm package ccb-app-ui-service — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-ccb-app-ui-service-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-fpx9-gqqh-c483) for the npm package ccb-app-ui-service, flagged as CWE-506 embedded malicious code. All versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Anyone who installed or ran the package is affected. Removal of the package alone is not guaranteed to remove all malicious software. No CVE is assigned; the advisory was published and reviewed on 2026-11-06.
Do: Rotate all secrets and keys stored on any machine where the package was installed or run, using a different, clean computer; Isolate and rebuild affected machines from trusted images rather than just uninstalling the package; Audit dependency trees and CI/CD environments for ccb-app-ui-service and block/remove it from registries and lockfiles; Review logs and credentials for signs of exfiltration or unauthorized access; Harden npm install pipelines with malware scanning and allowlists

### [critical] Malicious npm package zero2-baileys — full host compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-zero2-baileys-full-host-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-79c7-wq2p-hx6p) for the npm package zero2-baileys, flagged as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying the package grants attackers full control of the host, enabling theft of secrets, keys and credentials and persistence beyond simple removal. Anyone who installed zero2-baileys — likely developers seeking WhatsApp/Baileys-style automation libraries — is affected. There is no fix; remediation is removal of the package plus full incident response, since uninstalling cannot guarantee removal of all malicious software.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines immediately, using a clean computer; Isolate and rebuild affected machines; do not rely on uninstalling the package to remove the malware; Audit systems and CI/CD environments for installation of zero2-baileys and any persistence mechanisms or unauthorized access; Review access and network logs for signs of exfiltration or attacker activity; Block/flag zero2-baileys in dependency management and internal registries

### [critical] Malicious npm package @smart-dev-wa/baileys — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-smart-dev-wa-baileys-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub published advisory GHSA-h4v8-6rq8-9pg3 on 2026-11-06 flagging the npm package @smart-dev-wa/baileys as malware (CWE-506, embedded malicious code). All published versions (>= 0) are affected and there are no patched versions; the package appears to be a malicious fork/clone of the Baileys WhatsApp library. Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. Removal of the package alone does not guarantee removal of all malicious software. All secrets and keys on affected machines must be rotated from a clean computer.
Do: Immediately stop using and remove @smart-dev-wa/baileys from all projects and machines; Rotate all secrets, API keys, tokens and credentials stored on affected machines, from a clean computer; Rebuild/reimage affected machines; do not assume package removal removed the malware; Audit dependency lockfiles and CI environments for the package and any persistence it may have installed; Use the legitimate, vetted Baileys library (whiskeysockets/baileys) if WhatsApp automation is needed

### [critical] Malicious npm package @kora20030101/test-pkg-delete-me — full host compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-kora20030101-test-pkg-delete-me-full-host-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-g42p-gwv6-w549) for the npm package @kora20030101/test-pkg-delete-me, flagged under CWE-506 (embedded malicious code). All published versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. Anyone who installed the package — directly or as a transitive dependency — is affected. The package has no known source code repository. Remediation is incident response, not an upgrade: remove the package, rotate all secrets and keys from a clean machine, and rebuild/reimage affected hosts.
Do: Remove @kora20030101/test-pkg-delete-me from all projects and lockfiles and audit for transitive installs; Rotate all secrets, keys, and credentials stored on affected machines immediately, from a clean computer; Reimage or rebuild affected hosts; do not assume package removal removed the malware; Review logs and network traffic for signs of exfiltration or attacker access; Block the package in npm/CI policy and dependency scanning

### [critical] vfat-tools (npm): malicious package compromises any machine where installed; no safe version exists
https://helix.ml/threat-watch/i/vfat-tools-npm-malicious-package-compromises-any-machine-where-installed-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-06
GitHub's malware advisory database has flagged the npm package vfat-tools as containing embedded malicious code (CWE-506). All published versions (>= 0) are affected and there are no patched versions, meaning no version can be safely used. The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package sees roughly 458 downloads per month. Removal of the package alone is not guaranteed to eliminate all malicious software it may have installed. Developers and CI systems that pulled vfat-tools should treat secrets and keys on those machines as stolen and rotate them from a clean computer.
Do: Treat any machine with vfat-tools installed as fully compromised; rotate all secrets and keys from a different, clean computer; Remove the package and rebuild/reimage affected machines and CI runners where feasible; Audit dependency trees and lockfiles for vfat-tools and block/reject it in registries and CI; Review logs and network traffic for signs of exfiltration or attacker access; Rotate credentials, tokens, and signing keys that may have been accessible to compromised environments

### [critical] sickle-wrapper (npm): malicious package fully compromises machines that install it; no patched version exists
https://helix.ml/threat-watch/i/sickle-wrapper-npm-malicious-package-fully-compromises-machines-that-install-it-no-patched-version-exists · Supply chain · no-fix-needed · since 2026-11-06
GitHub published a malware advisory (GHSA-f64g-9rx5-4jxf) for the npm package sickle-wrapper on 2026-11-06. Every version (>= 0) is affected and no patched version exists, as the package is outright malware containing embedded malicious code (CWE-506). Any computer where the package is installed or running should be considered fully compromised, with control potentially handed to an outside entity. All secrets and keys stored on affected machines should be treated as stolen. Removal of the package is advised but may not eliminate all malicious software planted during installation. Any developer or CI environment that installed sickle-wrapper is affected.
Do: Rotate all secrets, keys, and credentials stored on machines where sickle-wrapper was installed, using a clean computer; Remove the package and rebuild/reimage affected machines from trusted images; Audit install logs and CI pipelines to identify when and where the package was pulled; Review access logs and network activity for signs of attacker control; Block sickle-wrapper in dependency policies and lockfiles

### [critical] Malicious npm packages @exclipz/baileys and @exclipz/bails — typosquat-style malware grants full host compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-exclipz-baileys-and-exclipz-bails-typosquat-style-malware-grants-full-host-compromise · Supply chain · no-fix-needed · since 2026-11-06
GitHub published malware advisories on 2026-11-06 for two npm packages, @exclipz/baileys and @exclipz/bails, flagged as containing embedded malicious code (CWE-506). The names closely resemble the popular Baileys WhatsApp automation library, suggesting typosquatting or a compromised fork-style publication. GitHub's guidance states that any computer with these packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity. All versions (>= 0) are affected and no patched versions exist. Downloads are low (~39/month for @exclipz/bails), limiting reach, but any installation exposes secrets, keys, and credentials. Removal of the package does not guarantee removal of the malicious software.
Do: Check lockfiles and installed node_modules for @exclipz/baileys or @exclipz/bails and remove them; Treat any machine where they ran as fully compromised: rotate all secrets, keys, and credentials from a clean machine; Rebuild/reimage affected hosts and audit for persistence mechanisms; Audit npm install logs and CI pipelines for historical installs of these packages; Pin dependencies and verify package names carefully against the legitimate Baileys library (whiskeysockets/baileys)

### [high] XCPE Botnet: Videostrong Android TV set-top boxes — OEM preinstalled backdoor enrolled 1.3M+ devices in botnet (no CVE)
https://helix.ml/threat-watch/i/xcpe-botnet-videostrong-android-tv-set-top-boxes-oem-preinstalled-backdoor-enrolled-1-3m-devices-in-botnet-no-cve · Supply chain · unpatched · since 2026-11-02
Google Threat Intelligence Group, working with Japan's National Police Agency, Lumen, HUMAN Security, Plume, Synthient and TrendAI, disrupted the XCPE backdoor and the botnet it built. Google says it assesses with high confidence that Videostrong Technology Co., an Android OEM/ODM, built, deployed and ran the backdoor for financial gain, and that it has been in the firmware since at least late 2024. The backdoor (x.cpe, also seen as com.oemservice) is preloaded at system privilege, reinstalls itself from the /oem/ partition after a user uninstalls it, and takes commands over HTTP and MQTT. Videostrong sold access to criminal affiliates, whose modules run ad fraud, residential proxy services (Linkfog, AppSalt, NetNut) and further malware. Google reports more than 1.3 million set-top boxes enrolled and assesses that taking down the affiliate C2 domains cuts off at least 10 million more devices. The infected devices span many device models and brands, not only Videostrong-made boxes, and also include telehealth devices, karaoke machines and digital signage. Google has banned Videostrong from building certified Android devices, is improving firmware-integrity checks for certified Android TV devices, and publishes no removal procedure for devices already infected.
Do: Search device fleets for com.oemservice, x.cpe, com.abc.nexus and the newer dropper packages com.android.system.ntp and com.android.sso.auth.handler, which Google reports on the botnet since August 2026; Treat any device carrying these packages as compromised and isolate or replace it; Google publishes no removal procedure, and the stub reinstalls from the /oem/ partition after uninstall; Block the C2 and staging hosts Google names: mqtt.szbboys[.]com, ott.szbboys[.]com, mcstb.anyevonline[.]com and stb*.anyevonline[.]com; Check guest and IoT networks for residential-proxy or ad-fraud traffic from the Linkfog, AppSalt, NetNut, CBOXTV or HiddenView modules, and for devices where Google Play Protect verification has been switched off (package_verifier_user_consent set to -1)

### [high] cwpdoor: Control Web Panel (CWP) — backdoored cwpsrv web server executes hidden commands via signed web requests
https://helix.ml/threat-watch/i/cwpdoor-control-web-panel-cwp-backdoored-cwpsrv-web-server-executes-hidden-commands-via-signed-web-requests · Supply chain · unknown · since 2026-11-05
QiAnXin XLab's CWPdoor report (published 2026-11-05) describes a trojanized cwpsrv web server binary used by Control Web Panel, a Linux hosting control panel. A root-level shell installer named cwpsrv_update.sh, disguised as a version update, swaps in a replacement binary on cwpsrv versions 1.15.10 and 1.24.0 and restores the original file timestamps. The replacement binaries are served from an attacker-controlled IP, 136.0.141.71, not from a CWP download channel; XLab does not say how the installer first reaches a server. The implant runs commands carried in requests with X-Ngx-Integrity-Time, -Data and -Sig headers, which it checks by RSA signature and AES-encrypted payload, and it suppresses logging for those requests. XLab cites more than 340,000 CWP instances exposed to the internet in one month, but reports no infected-server count. Exploitation is XLab's inference: an archive holding the backdoor and an Ebury component was uploaded to VirusTotal from Brazil on 2026-09-30, and the backdoor sample had zero detections, which XLab reads as proof that real victims exist; the link between the two implants is unclear. No vendor response, fixed build or CISA KEV entry was found. Remediation: restore a cwpsrv.prev-* backup if one exists, upgrade to the latest CWP, confirm no ngx_http_integrity_helper unix socket remains, rotate panel credentials, and treat the host as fully compromised.
Do: Check for infection: run ss -axp | grep integrity (look for ngx_http_integrity_helper), ps aux | grep cwpsrv for unexpected helper processes, and strings /usr/local/cwpsrv/bin/cwpsrv | grep X-Ngx-Integrity; Hunt egress, proxy and web logs for 136.0.141.71 and for the paths /static/cwpsrv_update.sh, /static/cwpsrv_1.15.10 and /static/cwpsrv_1.24.0; If infected, restore the original cwpsrv from the cwpsrv.prev-* backup in /usr/local/cwpsrv/bin if it exists (XLab notes the installer deletes that backup after a successful health check); Upgrade CWP/cwpsrv to the latest version and confirm ss -axp | grep integrity returns nothing; Rotate all control panel and server credentials, since the backdoor allows arbitrary command execution; Treat the server as fully compromised and hunt for additional threats (e.g. Ebury) and persistence mechanisms

### [high] Poisoned Source (APT29): Plerdy analytics hijack serves iOS and Chrome n-day exploit chains (CVE-2026-3910)
https://helix.ml/threat-watch/i/poisoned-source-apt29-watering-hole-ios-android-users-n-day-mobile-exploit-chains-steal-cookies-messages-wi-fi-passwords · Supply chain · patched · since 2026-11-04 · CVE-2024-27834, CVE-2025-14174, CVE-2025-27038, CVE-2025-43510, CVE-2025-43520, CVE-2025-43529, CVE-2026-20700, CVE-2026-3910
Sekoia's Threat Detection & Research team found the 'Poisoned Source' campaign in mid-October 2026 and published its write-up on 2026-11-04. Sekoia assesses with moderate to high confidence that APT29 (also tracked as Midnight Blizzard or Cozy Bear, linked to Russia's SVR) conducted it. Three delivery routes were used: script injection on compromised websites (a US chemical-industry trade association, a far-right European political party, a Bulgarian military-related site, a Ukrainian gas producer, and others), lookalike domains imitating America250 and a Raffles London hotel site, and a supply-chain compromise of the Plerdy SEO Tracker script (a.plerdy[.]com/public/js/click/main.js), which thousands of mostly Ukrainian sites load, between 27 August and 3 September 2026. The compromised script reached army, special-forces and military-equipment sites. A device-profiling loader serves a platform-specific chain: iOS 16.7 cookie theft; iOS 18.5 full-device collection through the DarkSword framework (SMS and iMessage, WhatsApp and Telegram databases, Wi-Fi keys, Keychain); and Chrome 139 to 145, excluding 143, which runs AndroSnitch to collect Chrome data and Wi-Fi passwords. Sekoia reports no persistence and sends the data to ad.starx-net[.]com. Sekoia says each exploited flaw was resolved by its vendor before the campaign began. Sekoia gives no victim or device counts, does not say how Plerdy responded, and thanks CERT-UA for collaboration.
Do: Ensure all mobile devices (iOS and Android/Chrome) are fully updated to current patched versions; Review whether your sites embed the Plerdy SEO Tracker script (a.plerdy[.]com/public/js/click/main.js) or other third-party analytics scripts, and audit them for injected code; Deploy CSP and subresource integrity where feasible to detect and limit malicious script injection on web properties; Monitor for connections to ad.starx-net[.]com:8881/telemetry/v12 and related infrastructure; Hunt for signs of compromise on iOS and Android devices used by high-risk staff; Block lookalike domains such as america250[.]holiday and monitor for typosquatted high-profile sites

### [critical] Malicious npm package itc-actors-api — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-itc-actors-api-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-05
GitHub published a malware advisory (GHSA-w2fv-53fr-6qwg) on 2026-11-05 for the npm package itc-actors-api, flagging it as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists. The advisory states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal of the package alone cannot be assumed to remove all malicious software. Any developer, CI system, or end user that installed the package is affected; secrets and keys on those machines are presumed stolen. No fix will be issued; remediation is removal plus incident response.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine where itc-actors-api was installed, using a clean machine; Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the system; Audit dependency lockfiles, CI caches, and artifacts for itc-actors-api and block it in registries/proxies; Review access and network logs for signs of attacker activity following installation; Notify downstream users if the package entered your published artifacts

### [critical] @gemshell/win32-x64 npm package is malware — full machine compromise for installers of v1.2.1
https://helix.ml/threat-watch/i/gemshell-win32-x64-npm-package-is-malware-full-machine-compromise-for-installers-of-v1-2-1 · Supply chain · no-fix-needed · since 2026-11-05
GitHub's malware advisory database flagged the npm package @gemshell/win32-x64 version 1.2.1 as containing embedded malicious code (CWE-506). Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated from a clean computer. There are no patched versions and no known source code — the package is malware, so remediation is removal plus incident response, not an upgrade. Anyone who installed version 1.2.1 is affected; the advisory was published and reviewed on 2026-11-05.
Do: Treat any machine with @gemshell/win32-x64@1.2.1 installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and rebuild/reimage affected systems; do not assume removal clears the malware; Audit dependency trees and CI caches for the package and block it in npm registries/proxies

### [critical] Malicious npm package test1817 — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-test1817-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-05
GitHub published a malware advisory (GHSA-jfvg-hq3f-9865) for the npm package test1817 on 2026-11-05. All versions (>= 0) are affected and no patched version exists. The package contains embedded malicious code (CWE-506) that gives an outside entity full control of any computer where it is installed or running, meaning secrets and keys on affected machines should be considered stolen. Removal of the package does not guarantee removal of the malicious software it deployed. Any developer or CI environment that installed test1817 should be treated as fully compromised.
Do: Rotate all secrets, keys, and credentials stored on any machine where test1817 was installed, using a clean computer; Remove test1817 from all projects, lockfiles, and CI pipelines and audit for persistence mechanisms; Rebuild or wipe affected machines and CI runners from trusted images; Review npm audit logs and dependency history for when test1817 was introduced; Block the package name in internal registries and dependency scanning

### [critical] @db-tools/main-app (npm) — malicious package compromises any machine where it is installed
https://helix.ml/threat-watch/i/db-tools-main-app-npm-malicious-package-compromises-any-machine-where-it-is-installed · Supply chain · no-fix-needed · since 2026-11-05
GitHub's malware advisory database published GHSA-fwf6-6x3c-6g3h on 2026-11-05 flagging the npm package @db-tools/main-app as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists. GitHub states that any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity; secrets and keys stored on affected machines are at risk. Removal of the package alone is not guaranteed to remove all malicious software it installed. Any developer, CI system, or production environment that pulled this package from npm is affected. There is no fix; remediation is removal plus credential rotation and host forensics/rebuild.
Do: Remove @db-tools/main-app from all projects, lockfiles, and CI pipelines immediately; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using an uninfected computer; Rebuild or forensically clean affected hosts; do not assume package removal fully removes the malware; Audit npm dependency trees and lockfiles for the package and any related suspicious dependencies; Review access logs and monitor for suspicious activity from affected systems

### [critical] Malicious npm packages plain-lang and talk-lang flagged as malware — full system compromise
https://helix.ml/threat-watch/i/malicious-npm-packages-plain-lang-and-talk-lang-flagged-as-malware-full-system-compromise · Supply chain · no-fix-needed · since 2026-11-05
GitHub's advisory database published malware advisories on 2026-11-05 for two npm packages, plain-lang (GHSA-28wv-5h54-vmjx, ~11 downloads/month) and talk-lang (GHSA-3x5r-f82m-84w9, ~17 downloads/month). Both are classified as embedded malicious code (CWE-506) with all versions (>= 0) affected and no patched versions or known source code. Per the advisories, any computer with these packages installed or running should be considered fully compromised, with attacker control of the machine and exposure of stored secrets and keys. Removal of the package does not guarantee removal of all malicious software. Any developer or CI environment that installed either package is affected; no fix exists other than removal and remediation.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine that installed plain-lang or talk-lang, using a clean computer; Remove both packages from all systems, lockfiles, and CI pipelines, and audit for persistence mechanisms; Rebuild affected machines from trusted images rather than trusting uninstall; Review npm install and CI logs to determine when the packages were introduced and what may have been exfiltrated; Block both package names in dependency policy and internal registries

### [critical] dsh-purge npm package is malware — full machine compromise for installs of v1.2.1 (no CVE)
https://helix.ml/threat-watch/i/dsh-purge-npm-package-is-malware-full-machine-compromise-for-installs-of-v1-2-1-no-cve · Supply chain · no-fix-needed · since 2026-11-05
GitHub's malware advisory database published GHSA-w7xp-2vj9-g24m on 2026-11-05 flagging the npm package dsh-purge version 1.2.1 as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched versions exist and no known source code is available; the package has roughly 13K GitHub stars per the advisory data, indicating meaningful reach. Anyone who installed dsh-purge 1.2.1 should treat secrets and keys on affected machines as stolen. Removal of the package alone is not guaranteed to remove all malicious software. There is no fix; remediation is incident response: rotate credentials and rebuild affected systems.
Do: Rotate all secrets, keys, and credentials stored on machines where dsh-purge 1.2.1 was installed, using a clean computer; Remove the package and rebuild/reimage affected machines, as removal may not eliminate all malicious software; Audit systems and CI environments for the package and review logs for signs of compromise; Block the package in dependency policies and check lockfiles and dependency caches for dsh-purge

### [medium] GhostMap: Android APK ZIP parser — malicious APK triggers SIGBUS crash loop, possible factory reset (no CVE)
https://helix.ml/threat-watch/i/ghostmap-android-apk-zip-parser-malicious-apk-triggers-sigbus-crash-loop-possible-factory-reset-no-cve · Supply chain · unpatched · since 2026-11-05
Bitdefender Labs reported GhostMap, an AOSP flaw in how Android's two ZIP-handling libraries treat an APK entry that declares an unsupported compression method. Both libraries accept the entry as stored, so it is mapped at the declared size, which can run past the end of the file; the first read beyond the real end raises SIGBUS and kills the reading process. A malformed manifest crashes the package installer, and a malformed resource that system_server reads after install causes a boot loop that also occurs in safe mode. Clearing the loop can require a factory reset; BleepingComputer also lists deleting the malformed file over ADB, which needs debugging enabled beforehand. The proof of concept is an app with no code and no permissions, tested on a Pixel 10 running Android 17 with the 5 August 2026 security patch. Bitdefender says the bug is in AOSP from Android 10 onward and did not test other vendors. Google closed the report as Won't Fix (Not Reproducible), then ruled it out of scope for a security fix and passed it on for possible inclusion in a future release. No CVE has been assigned and no security fix is planned. Bitdefender has seen no in-the-wild use; the technique was found through a banking dropper that used a packer.
Do: Block installation of untrusted APKs and third-party app stores; rely only on vetted app sources; Monitor for devices entering boot loops after app installs and quarantine affected handsets; Back up device data regularly, as clearing the loop can require a factory reset; Track Android security bulletins in case Google adds a fix; none is planned as of the November 2026 reporting; Consider mobile EDR or anti-malware, noting that third-party tools may warn about a malformed APK but cannot block its installation

### [high] Malicious PyPI package dbt-adapter exfiltrates host info on install/import (no CVE)
https://helix.ml/threat-watch/i/malicious-pypi-package-dbt-adapter-exfiltrates-host-info-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-11-05
GitHub Advisory Database published GHSA-jcpx-v43r-522m on 2026-11-05 flagging the PyPI package dbt-adapter as malicious. Installing the package or importing the module exfiltrates basic host information such as IP address and username, and the package has no other purpose. The package overrides the install command in setup.py to execute malicious code during installation. Affected versions are 0.0.0 and 0.1.0a2; there are no patched versions, and the package is classified as malware (CWE-506) under the OpenSSF malicious-packages project and kam193's bad-packages database. Anyone who installed or imported dbt-adapter from PyPI is affected; the legitimate dbt adapter ecosystem is not implicated. Remediation is removal of the package and investigation of the exfiltrated host data.
Do: Remove dbt-adapter from all environments and dependency files; do not install or import it; Audit systems where it was installed for signs of data exfiltration (IP, username) and rotate any credentials on those hosts; Check pip install logs and CI pipelines for historical installs of the package; Block the package name in internal PyPI mirrors/proxies and pin verified dependencies with hashes; Prefer the official dbt adapters (dbt-postgres, dbt-snowflake, etc.) from verified publishers

### [critical] pino-testkit campaign: loader-utils-kit, pino-std, @k.vict1999/pino-std-serializers — malicious npm packages execute obfuscated code on install/import (no CVE)
https://helix.ml/threat-watch/i/pino-testkit-campaign-loader-utils-kit-pino-std-k-vict1999-pino-std-serializers-malicious-npm-packages-execute-obfuscate · Supply chain · no-fix-needed · since 2026-11-05
On 2026-11-05 GitHub's advisory database published three malware advisories for npm packages loader-utils-kit (4.2.1, 4.3.5), pino-std (7.2.0) and @k.vict1999/pino-std-serializers (7.2.0). Each ships lib/contract.js, byte-identical to the pino-testkit payload (MAL-2026-16484): an obfuscated module that decodes and evaluates code at load time. The packages masquerade as ordinary utilities (pino-std is a copy of the pino logger with the extra payload), so the malicious code runs on import or install without the user's knowledge. The packages are typosquat-style rebrandings of the same campaign; no patched versions exist and the packages should be treated as fully compromised. Any project that installed or imported them should assume code execution and potential credential theft on affected machines.
Do: Remove and uninstall the affected packages; do not update to any version; Audit lockfiles and dependency trees for loader-utils-kit, pino-std and @k.vict1999/pino-std-serializers; Assume compromise of any machine where they ran: rotate npm, git, cloud and CI credentials and secrets; Review logs and processes for suspicious post-install activity; Pin dependencies and enable npm audit / GitHub advisory blocking to prevent reintroduction

### [critical] Dependency-confusion beacon campaign: wiasdcxc, wiselllx, wisewwasd, wxwxtt (npm) — postinstall exfiltrates host info
https://helix.ml/threat-watch/i/dependency-confusion-beacon-campaign-wiasdcxc-wiselllx-wisewwasd-wxwxtt-npm-postinstall-exfiltrates-host-info · Supply chain · no-fix-needed · since 2026-11-05
Four npm packages — wiasdcxc, wiselllx, wisewwasd and wxwxtt — published as dependency-confusion/typosquat malware and flagged by GitHub/OpenSSF on 2026-11-05 belong to the same campaign as the previously reported 'troubleshooting' package (MAL-2026-17641). Each ships a postinstall script that runs beacon.cjs, which POSTs the installing host's name, install path and working directory to a hard-coded collector; index.js, byte-identical to the troubleshooting payload (sha256 a86a4da763bbb34c16f361abe7aab66d5df591b66867ac8160041f932159b08d), performs the same exfiltration on import. Affected versions span 0.0.0 through 99.0.1 depending on the package. No patched versions exist; any install or import executes the beacon. Organisations with these packages in lockfiles or CI caches should treat hosts as beaconed and rotate any secrets accessible from build environments.
Do: Search all lockfiles, CI logs and package caches for wiasdcxc, wiselllx, wisewwasd and wxwxtt and remove them; Treat any machine that installed them as beaconed: review egress to the collector, rotate CI/CD and npm tokens and secrets reachable during install; Block the packages in npm proxy/registry policy and enable dependency-confusion protections (scoped registry mappings, --ignore-scripts where feasible); Audit build environments for follow-on activity; monitor for related campaign package names

### [critical] nebulajs-api campaign: testtestkjkldfnjdfn (npm) — malicious package runs obfuscated payload on install/import (no CVE)
https://helix.ml/threat-watch/i/nebulajs-api-campaign-testtestkjkldfnjdfn-npm-malicious-package-runs-obfuscated-payload-on-install-import-no-cve · Supply chain · no-fix-needed · since 2026-11-05
A new npm package, testtestkjkldfnjdfn, was published with malicious code and flagged by GitHub Advisory GHSA-j4mg-x22p-3q6m (MAL-2026-18697) on 2026-11-05. It ships nebula.js, byte-identical to the payload of the earlier nebulajs-api campaign (MAL-2026-17220), plus a preinstall.cjs consisting of a single opaque Function(...) call that decodes XOR-encrypted code at install time. The package poses as an ordinary utility, so the payload runs on install or import without user awareness. Only version 1.0.0 is affected and there are no patched versions; the fix is removal. Any developer or CI system that installed the package is affected. Organisations should audit lockfiles and npm install logs for the package name and version, remove it, rotate any credentials accessible from affected machines, and block the package name in registry proxies.
Do: Search dependency lockfiles, node_modules, and CI logs for testtestkjkldfnjdfn@1.0.0 and remove it if found; Rotate any secrets, tokens, or credentials that could have been accessible from machines or CI runners where the package was installed; Block the package name (and related nebulajs-api names) in npm registry proxies/allowlists and alert on future publications; Rebuild affected environments from clean images and review for persistence or post-install artifacts

### [critical] synapse-hub (npm): malicious package 3.1.0 fully compromises machines that install it (GHSA-q7g7-jwp5-cvgh)
https://helix.ml/threat-watch/i/synapse-hub-npm-malicious-package-3-1-0-fully-compromises-machines-that-install-it-ghsa-q7g7-jwp5-cvgh · Supply chain · no-fix-needed · since 2026-11-05
GitHub's advisory database published a malware advisory (GHSA-q7g7-jwp5-cvgh, CWE-506 Embedded Malicious Code) for the npm package synapse-hub, version 3.1.0. The advisory states that any computer with the package installed or running should be considered fully compromised, implying full control may have been handed to an outside entity. No patched versions exist; the package should not be used at all. All secrets and keys stored on affected machines should be rotated immediately from a different, clean computer. Removing the package does not guarantee removal of all malicious software it may have installed. Any developer or CI environment that installed synapse-hub 3.1.0 is affected.
Do: Treat any machine that installed or ran synapse-hub 3.1.0 as fully compromised; rebuild from clean images; Rotate all secrets, keys, and credentials stored on affected machines immediately, from a different computer; Remove the package and audit for persistence mechanisms and additional malware it may have dropped; Review logs and network traffic for signs of exfiltration or attacker access; Block synapse-hub in dependency allowlists and scan repositories and lockfiles for it

### [critical] strands-aidr (PyPI) — malicious package exfiltrates host info on install/import
https://helix.ml/threat-watch/i/strands-aidr-pypi-malicious-package-exfiltrates-host-info-on-install-import · Supply chain · no-fix-needed · since 2026-11-05
GitHub Advisory Database (GHSA-5rm4-gf65-6756, published 2026-11-05) flags the PyPI package strands-aidr as malware. Version 9999.0.0 overrides the install command in setup.py so malicious code runs during pip install, and importing the module also exfiltrates basic host information such as IP address and username. The package has no legitimate purpose and there is no patched version — removal is the only remediation. Categorized as PROBABLY_PENTEST under the GENERIC-standard-pypi-install-pentest campaign, with limited-risk data exfiltration. Anyone who installed or imported strands-aidr is affected; no in-the-wild exploitation details are given.
Do: Check environments and lockfiles for strands-aidr and remove it if present; Audit pip logs and CI history for installs of strands-aidr version 9999.0.0; Treat affected hosts as potentially disclosed: rotate credentials, review network egress logs for exfiltration; Block the package name in internal PyPI mirrors/proxies and alert on install attempts

### [high] OpsShield cPGuard supply chain attack: malicious updates pushed to ~2,950 Linux hosting servers
https://helix.ml/threat-watch/i/opsshield-cpguard-supply-chain-attack-malicious-updates-pushed-to-2-950-linux-hosting-servers · Supply chain · patched · since 2026-11-02
An attacker first used a free trial account to reach OpsShield's billing and licensing server at manage.opsshield.com, and by 1 Nov 2026 22:58 UTC could run commands there. Using a stolen access key, they uploaded malicious cPGuard 5.88.12 through 5.88.19 to the update storage at 02:04-02:09 UTC on 2 Nov 2026. Agents that polled during the roughly 70-minute window (02:08-03:20 UTC) installed the script, which ran as root. It copied /etc/shadow and /etc/passwd, root SSH keys, the MySQL root config, root shell history, and on a small number of servers S3 keys, then left a setuid root shell at /var/tmp/.cpg91511_sh and a scheduled task. The vendor counts about 2,950 servers that ran the update and about 7,900 billing-portal account records (name, company, postal address, email, bcrypt hash) copied. The collected files were uploaded to the vendor's own licensing server, and the attacker has retrieved 32 per-server bundles so far (preliminary). The entry point into the billing system is not yet established. Clean release 5.88.26 removes the root shell, and a follow-up update removes the i93677 scheduled task. The vendor cites no CVE.
Fixed: 5.88.25; 5.88.26
Do: Update cPGuard to 5.88.26 or later (the vendor's 3 Nov advisory names 5.88.25 as the minimum corrective version) and verify with cpgcli --version; Confirm /etc/cron.d/i93677, /var/tmp/.i93677/, /var/tmp/.cpg91511_sh and /var/tmp/.cpg91511/ are gone; delete them if not; Treat any server that had cPGuard online between 02:08 and 03:20 UTC on 2 Nov 2026 as exposed: reset root and all password-enabled local Linux account passwords from a trusted recovery environment; Rotate the MySQL root password (including /root/.my.cnf), S3 keys in /root/.s3cfg, DigitalOcean tokens, and any secret in root shell history; Replace SSH private keys under /root/.ssh and remove the old public keys from authorized_keys on every system that trusted them; treat hosts reached from this server with those keys as exposed; Reset the manage.opsshield.com billing portal password and enable two-factor login, even if cPGuard was offline during the window; Rebuild from a clean backup taken before 1 Nov 2026 only if the vendor confirms a manual login or the server's integrity cannot be established (the vendor's two notices differ on routine rebuilds; the 3 Nov advisory does not recommend a routine rebuild)

### [critical] npm typosquat malware wave: heheheshsds, thththtbhthhth, @saidddddddddd/* — malicious packages fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/npm-typosquat-malware-wave-heheheshsds-thththtbhthhth-saidddddddddd-malicious-packages-fully-compromise-installed-machin · Supply chain · no-fix-needed · since 2026-11-04
On 2026-11-04 GitHub published four malware advisories for npm packages heheheshsds, thththtbhthhth, @saidddddddddd/ggsgg and @saidddddddddd/somethingelse, all flagged CWE-506 (embedded malicious code) with every version (>=0) affected and no patched versions. The advisory language indicates these packages hand full control of the machine to an outside entity, so any computer where they were installed or run must be considered fully compromised, with secrets and keys at risk of exfiltration. The gibberish package and scope names suggest a coordinated typosquat or spam-style malicious publishing campaign. There is no fix; removal of the package does not guarantee removal of the attacker's malware, so affected hosts require full incident response including credential rotation and rebuild.
Do: Check dependency trees and lockfiles for heheheshsds, thththtbhthhth, @saidddddddddd/ggsgg and @saidddddddddd/somethingelse; treat any hit as a confirmed compromise; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean machine; Isolate and rebuild/reimage affected hosts; do not rely on uninstalling the package to remove the malware; Review logs for outbound connections and attacker activity since the package was installed; Block/flag the packages and publisher accounts in your registry proxy or allowlist

### [critical] Malicious npm packages @secauditb20y/sec-test-r3b, @secaudita10x/sec-test-a1, @secauditb20y/sec-test-b1 flagged as malware
https://helix.ml/threat-watch/i/malicious-npm-packages-secauditb20y-sec-test-r3b-secaudita10x-sec-test-a1-secauditb20y-sec-test-b1-flagged-as-malware · Supply chain · no-fix-needed · since 2026-11-04
GitHub's advisory database published three malware advisories on 2026-11-04 covering npm packages @secauditb20y/sec-test-r3b (GHSA-h95w-3ffr-98m2), @secaudita10x/sec-test-a1 (GHSA-pgq7-5652-37p2) and @secauditb20y/sec-test-b1 (GHSA-4rp3-383p-p8qj). All versions (>= 0) are affected, with no patched versions available, and each carries CWE-506 (Embedded Malicious Code). GitHub's standard malware guidance states any machine with these packages installed or running should be considered fully compromised, with attacker access to secrets and keys. The package names suggest deliberately planted test/malicious packages rather than typosquats of real libraries. Any developer or CI system that installed them is at risk of credential theft and persistent compromise; removal of the package alone does not guarantee remediation.
Do: Immediately remove the packages from all projects, lockfiles and CI caches; Rotate all secrets, keys and tokens stored on or accessible from affected machines, using a clean machine; Rebuild affected machines or containers from trusted images; do not assume removal fully cleans the host; Audit npm install logs, CI pipelines and lockfiles for any occurrence of these package names; Block the @secauditb20y and @secaudita10x scopes in registry proxies and dependency firewalls

### [critical] Malicious npm package nminer 3.0.0 fully compromises installed machines
https://helix.ml/threat-watch/i/malicious-npm-package-nminer-3-0-0-fully-compromises-installed-machines · Supply chain · no-fix-needed · since 2026-11-04
GitHub's malware advisory database flagged the npm package nminer version 3.0.0 as embedded malicious code (CWE-506), published 2026-11-04. Any machine with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. The package reportedly sees around 60,000 downloads per month, so exposure could be broad. No patched version exists; the advisory recommends removal, but warns removal cannot guarantee elimination of all malicious software planted during installation. Secrets and keys stored on affected machines should be treated as stolen and rotated from a clean computer. Exploitation is presumed active given the malware classification.
Do: Treat any machine with nminer 3.0.0 installed as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on affected machines from a clean computer; Remove the package and rebuild/reimage affected systems rather than trusting cleanup; Audit for persistence mechanisms and unauthorized access following installation; Block nminer in dependency resolution and check lockfiles and CI caches for it

### [critical] npm malware: @adminide-stack packages — malicious versions fully compromise installed machines (no CVE)
https://helix.ml/threat-watch/i/npm-malware-adminide-stack-packages-malicious-versions-fully-compromise-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-04
On 2026-11-04 GitHub published four malware advisories (CWE-506) against npm packages in the @adminide-stack scope: @adminide-stack/utils 0.0.16-130, @adminide-stack/client-redux 0.0.16-18, @adminide-stack/health-api-server 0.0.18-alpha.465, and @adminide-stack/user-activity-browser 0.0.16-129 and 1.1.3-alpha.114. Each advisory states that any computer with the package installed or running should be considered fully compromised, implying attacker control of the host and access to secrets and keys. No patched versions exist; removal of the package does not guarantee removal of the malicious software. Combined downloads are roughly 1,400/month, so exposure is limited but real for any project depending on these packages.
Do: Rotate all secrets, keys, tokens and credentials stored on or accessible from any machine where these packages were installed, using a clean machine; Remove the affected @adminide-stack packages from all projects and lockfiles and rebuild from trusted sources; Reimage or fully rebuild compromised machines; do not assume uninstalling the package removes the malware; Audit install and CI logs to determine when and where affected versions were pulled; Block the @adminide-stack scope in npm installs and add dependency allowlisting/scanning to prevent reintroduction

### [critical] Malicious npm package kvarzo-8f3a2-testmetest — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-kvarzo-8f3a2-testmetest-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-04
GitHub published a malware advisory (GHSA-cfr8-88wx-3j9g) for the npm package kvarzo-8f3a2-testmetest on 2026-11-04. All versions (>= 0) are classified as embedded malicious code (CWE-506) with no patched version available. Any machine with the package installed or running should be considered fully compromised, as the malware may grant full control to an outside entity. Secrets and keys stored on affected machines are at risk and must be rotated. Removal of the package does not guarantee removal of all malicious software. No CVE is assigned; no fixed version exists, so remediation is removal plus host forensics and credential rotation.
Do: Rotate all secrets and keys from a clean machine immediately; Remove the package and rebuild/reimage affected systems; Audit dependency trees and lockfiles for the package and block it in registries/proxies; Review systems for persistence and signs of attacker control; Check CI/CD and developer machines that may have installed the package

### [critical] data-sync-utils (npm): malicious package compromises any machine where it is installed; no safe version exists
https://helix.ml/threat-watch/i/data-sync-utils-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-04
GitHub's malware advisory database has flagged the npm package data-sync-utils as embedded malicious code (CWE-506), published 2026-11-04. Every version (>= 0) is affected and no patched version exists. Per the advisory, any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software. All secrets and keys on affected machines must be rotated from a clean computer. Any developer, CI system, or deployment that installed data-sync-utils at any version is affected.
Do: Treat any machine that installed or ran data-sync-utils as fully compromised; rebuild from trusted images; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, from a clean computer; Audit npm lockfiles and CI caches for data-sync-utils and block/remove it from registries and pipelines; Review logs and network traffic for signs of exfiltration or attacker access; Force credential resets (npm, git, cloud tokens) for users on affected hosts

### [critical] Malicious npm package mock-datas-lib — full host compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-mock-datas-lib-full-host-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-04
GitHub's advisory database published a malware advisory for the npm package mock-datas-lib on 2026-11-04 (GHSA-33jq-j4x3-75pc). Every version (>= 0) is classified as embedded malicious code (CWE-506) with no patched version available. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host, including access to secrets and keys. There is no known source code repository and no fix; removal of the package does not guarantee removal of the malicious software. Any developer or CI environment that installed the package is affected.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine where mock-datas-lib was installed, using a clean machine; Remove the package and rebuild/reimage affected machines; do not assume removal fully cleans the host; Audit npm lockfiles and CI caches for mock-datas-lib and block the package name in dependency firewalls; Review access logs and network traffic from affected hosts for signs of attacker activity; Notify security teams of potential credential exposure from developer workstations and CI runners

### [critical] Malicious msgpackrpc on PyPI — install/import exfiltrates host info (no CVE)
https://helix.ml/threat-watch/i/malicious-msgpackrpc-on-pypi-install-import-exfiltrates-host-info-no-cve · Supply chain · no-fix-needed · since 2026-11-04
The PyPI package msgpackrpc (versions 0.0.0 and 0.1.0) is malicious code with no legitimate purpose. Installing the package or importing the module exfiltrates basic host information such as IP address and username. The package overrides the install command in setup.py so malicious code executes during pip install. Classified by OpenSSF/kam193 as PROBABLY_PENTEST with limited risk, but GitHub lists it as critical malware with no patched versions. Anyone who installed or imported msgpackrpc from PyPI is affected; the legitimate msgpack-rpc-python ecosystem may be confused by the similar name. No fix exists — removal is the only remediation.
Do: Check environments for msgpackrpc (pip show msgpackrpc / dependency locks) and uninstall it immediately; Audit install and CI logs for execution of its setup.py; treat affected hosts' basic info (IP, username) as exposed; Rotate credentials if the exfiltrated data could aid follow-on attacks; review egress logs for exfil traffic; Block the package name in internal PyPI mirrors/dependency firewalls and pin safe alternatives (e.g. msgpack-rpc-python)

### [critical] extera-plugin-runtime / extera-runtime (PyPI): malicious packages exfiltrate Telegram files and run remote commands
https://helix.ml/threat-watch/i/extera-plugin-runtime-extera-runtime-pypi-malicious-packages-exfiltrate-telegram-files-and-run-remote-commands · Supply chain · no-fix-needed · since 2026-11-04
On 2026-11-04 GitHub's advisory database, crediting OpenSSF's malicious-packages project and researcher kam193, published malware advisories for two PyPI packages: extera-runtime (version 1.1.0) and extera-plugin-runtime (versions 1.0.0 and 1.0.1), linked to a campaign dubbed 2026-11-extera-plugin-runtime. The packages masquerade as runtime components for the extera Telegram plugin ecosystem and contain code to exfiltrate sensitive Telegram files and execute a limited set of remote commands on victims' machines. The malicious code does not start automatically, requiring user invocation, which limits but does not eliminate risk. No patched versions exist; the packages are outright malware and should be removed. Any developer or Telegram user who installed these packages should treat Telegram session data and files as potentially compromised.
Do: Immediately uninstall extera-runtime and extera-plugin-runtime from all environments and remove them from dependency files and caches; Rotate Telegram sessions and revoke active sessions; consider re-authenticating all Telegram accounts used on affected machines; Audit machines that ran the packages for signs of remote command execution and review what Telegram files may have been accessed; Block or flag these package names in internal PyPI mirrors, CI pipelines, and dependency-scanning tools; Check lockfiles and build histories for any historical installation of the affected versions

### [high] NIKKE PC launcher: tampered CDN scripts deliver K2F backdoor and credential theft
https://helix.ml/threat-watch/i/nikke-pc-launcher-supply-chain-attack-malicious-cdn-scripts-installed-k2f-backdoor-stealing-credentials-and-crypto-walle · Supply chain · partial · since 2026-11-04
Level Infinite, the publisher of NIKKE, posted on X that it had identified an issue indicating that the PC launcher's script files may have been tampered with by a third party, that client fixes and an update were implemented on 2026-11-04 at about 02:30 (UTC+9), and that the scope of impact is still under investigation. The technical chain comes from one independent researcher (MotherSphere) plus BleepingComputer's own analysis of two script files: four JavaScript files on the publisher's CDN were modified on 2026-09-27 around 06:41 GMT, and each one loaded a script from insightjs[.]com, falling back to insightjs[.]org. That script fetched a LuaJIT payload (insight.bundle) that installed K2F, a Lua remote-control agent able to run commands, read and download files, take screenshots, and harvest NIKKE account credentials and browser data. A Windows DLL that K2F can install reportedly steals crypto-wallet data (MetaMask, Phantom, Coinbase Wallet), but whether it was deployed is not confirmed. Per the researcher, three of the files were replaced on 2026-11-03 and the fourth stayed modified on some CDN servers until 2026-11-04. No affected-user count and no attribution has been published. Players should search Launcher/intl_service/debug.log for the string 'k2f_chan registered'; if it is present, run a full scan and, if compromise is confirmed, reinstall Windows and rotate passwords and wallet keys from a clean device.
Fixed: Client update 2026-11-04 ~02:30 UTC+9
Do: Run a full antivirus scan; check Launcher/intl_service/debug.log for 'k2f_chan' to detect the K2F agent; If compromise is confirmed, reinstall Windows and change all passwords, wallet recovery phrases and other credentials from a clean device; Update the NIKKE PC client/launcher to the fixed version issued 2026-11-04 and verify launcher scripts are clean; Assume browser-stored credentials and crypto wallet extensions may be exposed; move wallet keys off affected machines; Monitor publisher notices for scope-of-impact updates

### [critical] @pasqua-baileys/baileys npm package is malware — full machine compromise; rotate all secrets
https://helix.ml/threat-watch/i/pasqua-baileys-baileys-npm-package-is-malware-full-machine-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-04
GitHub published a malware advisory (GHSA-73vv-6qcp-qgpw) for the npm package @pasqua-baileys/baileys, an apparently malicious variant of the Baileys WhatsApp library. All versions (>= 0) are affected and there are no patched versions; the package embeds malicious code (CWE-506) that gives an outside entity full control of any machine where it is installed or running. Roughly 1,939 downloads per month indicate a limited but real install base. Any computer with the package should be treated as fully compromised, with secrets and keys exposed to the attacker. Removal of the package does not guarantee removal of all malicious software it may have installed. No fix exists; remediation is removal plus incident response.
Do: Treat any machine with @pasqua-baileys/baileys installed as fully compromised; isolate it immediately; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and rebuild/reimage affected systems; audit for persistence and additional malware; Audit dependency trees and lockfiles for the package and block it in registries/CI; Review logs and network traffic for signs of exfiltration or attacker access

### [critical] Malicious npm package that-fetch compromises all installed machines
https://helix.ml/threat-watch/i/malicious-npm-package-that-fetch-compromises-all-installed-machines · Supply chain · no-fix-needed · since 2026-11-04
GitHub's advisory database published a malware advisory (GHSA-cwjc-3f32-g7cg) for the npm package that-fetch, flagged as CWE-506 embedded malicious code. Every published version (>= 0) is affected and no patched version exists, meaning the package appears to have been malicious from the start rather than a hijacked legitimate library. Any machine with the package installed or running should be treated as fully compromised, with potential attacker control and exposure of secrets and keys. The advisory recommends immediate secret rotation from a clean machine and notes removal of the package does not guarantee removal of all malicious software. Published, reviewed and updated 2026-11-04.
Do: Treat any machine with that-fetch installed or running as fully compromised; Rotate all secrets and keys stored on affected machines immediately, from a different clean computer; Remove the package from all projects and lockfiles; Rebuild/reimage affected machines; do not assume removal removes all malware; Audit for persistence and unexpected network activity on affected hosts

### [critical] Overlord RAT: filipt malicious packages on PyPI and npm — setup.py/install-time malware gives attackers remote access (no CVE)
https://helix.ml/threat-watch/i/overlord-rat-filipt-pypi-package-malicious-setup-py-executes-rat-during-installation-no-cve · Supply chain · no-fix-needed · since 2026-11-03
The filipt malware campaign now spans two ecosystems. On PyPI, every published version (0.1.0–0.1.5) overrides the install command in setup.py so a malicious executable runs during wheel building/installation; the payload was identified as Overlord RAT, giving attackers remote access to any developer machine or CI runner where it is installed (GHSA-687f-xhmq-5mwg, catalogued 2026-11-03 as campaign 2026-11-filipt with VirusTotal and tria.ge confirmations). On 2026-11-04, GitHub Advisory Database published GHSA-56fp-mx7r-63x8 reporting malware in an npm package also named filipt, affecting all versions >= 0, warning that any machine with the package installed should be considered fully compromised and that removal does not guarantee removal of all malicious software. No patched versions and no known source code exist for either package; both should be treated as fully compromised and removed.
Do: Treat any machine or CI runner where filipt (PyPI or npm) was installed as compromised: isolate, reimage, and rotate all credentials, tokens and SSH keys from a clean machine; Search environments for filipt in dependency files, lockfiles, node_modules, pip caches and installed site-packages; remove it entirely, noting removal may not eliminate all implanted malware; Hunt for Overlord RAT indicators, including VirusTotal hashes 1a89eb45ed45780f16499b0f87ff3dd17db4be0988f7befbfa88224d83fccae2 and e5a585e03e1725d5030fd4854805933d53aa86cfbbb0b3808dffcc63782ddf38; Block the package name in internal PyPI and npm mirrors/proxies and review install logs for its presence; Review install hooks (setup.py, npm lifecycle scripts) in dependencies and enforce scanning/allowlists for PyPI and npm packages

### [critical] Malicious npm package noon-contracts — full system compromise on install; no safe version exists (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-noon-contracts-full-system-compromise-on-install-no-safe-version-exists-no-cve · Supply chain · no-fix-needed · since 2026-11-04
GitHub published advisory GHSA-qj9j-8fcr-pjq2 on 2026-11-04 flagging the npm package noon-contracts as malware (CWE-506, embedded malicious code). All versions (>= 0) are affected and no patched version exists; the package has been removed from distribution guidance entirely. Any machine with the package installed or running must be considered fully compromised, with attacker control of the host and access to secrets and keys. Roughly 303 downloads per month indicate limited but real exposure. Because full control may have been handed to an outside entity, uninstalling the package cannot be assumed to remove all malicious software. Remediation requires secret rotation from a clean machine and forensic rebuild of affected hosts.
Do: Immediately rotate all secrets, keys, and credentials stored on or accessible from machines where noon-contracts was installed, using a clean, uncompromised computer; Isolate and rebuild/reimage affected machines from trusted media; do not assume uninstalling the package removes the malware; Audit npm lockfiles and CI/CD environments for noon-contracts and any unexpected dependencies; Review logs and network traffic for signs of attacker access or exfiltration following installation

### [critical] @fyxzpediaa/baileys and @fyxzpediaa/libsignal npm packages are malware — full host compromise
https://helix.ml/threat-watch/i/fyxzpediaa-baileys-and-fyxzpediaa-libsignal-npm-packages-are-malware-full-host-compromise · Supply chain · no-fix-needed · since 2026-11-04
GitHub's advisory database published two malware advisories on 2026-11-04 for the npm packages @fyxzpediaa/baileys and @fyxzpediaa/libsignal, typosquat-style imitations of the popular Baileys WhatsApp library and libsignal. Every published version (>= 0) is flagged as containing embedded malicious code (CWE-506) with no patched versions available. GitHub's guidance states that any computer with these packages installed or running should be considered fully compromised, implying the malware grants outside attackers full control of the host. The baileys package shows roughly 2,945 downloads per month, indicating real-world exposure. Affected users must remove the packages, rotate all secrets and keys from a clean machine, and reimage/rebuild compromised hosts, since removal alone cannot guarantee the malicious software is gone.
Do: Remove @fyxzpediaa/baileys and @fyxzpediaa/libsignal from all projects and lockfiles and block them in your dependency allowlist; Rotate all secrets, API keys, tokens and credentials stored on any machine where the packages were installed, using a clean computer; Rebuild or reimage affected machines; removal of the package does not guarantee removal of the malware; Audit CI/CD pipelines and developer workstations for installs of these packages and review logs for signs of compromise; Switch to the legitimate, well-known upstream packages (e.g. official Baileys/libsignal forks) if WhatsApp automation is required

### [critical] Malicious npm package canta-baileys — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-canta-baileys-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-04
GitHub's malware advisory database flagged the npm package canta-baileys as containing embedded malicious code (CWE-506), published 2026-11-04. All versions (>= 0) are affected and no patched version exists — the package itself is the malware. Any machine where it is installed or running must be considered fully compromised, with potential attacker control enabling theft of secrets, keys, and credentials and persistence beyond simple package removal. Anyone who installed the package via npm is affected. There is no fix; remediation is removal plus full incident response on affected hosts.
Do: Rotate all secrets, keys, and credentials stored on or accessible from affected machines immediately, using a clean computer; Remove the canta-baileys package and audit affected hosts for persistence, as removal alone may not eliminate the malware; Rebuild/reimage compromised machines from trusted media; Audit dependency trees and lockfiles for canta-baileys and block it in CI/CD and registry proxies

### [critical] Malicious npm packages @realvare/based and @realvare/baileys — full host compromise; remove and rotate secrets
https://helix.ml/threat-watch/i/malicious-npm-packages-realvare-based-and-realvare-baileys-full-host-compromise-remove-and-rotate-secrets · Supply chain · no-fix-needed · since 2026-11-04
GitHub's Advisory Database published malware advisories on 2026-11-04 for two npm packages under the @realvare scope: @realvare/based (GHSA-r5hx-v68j-8w57, ~2,348 downloads/month, 10 GitHub stars) and @realvare/baileys (GHSA-3959-8jgw-g6xp, ~529 downloads/month). Both are flagged CWE-506 Embedded Malicious Code, affect every version (>= 0), and have no patched versions. GitHub's guidance states any computer with the packages installed or running should be considered fully compromised, with full control potentially handed to an outside entity, and removal of the package may not remove all malicious software. The baileys name suggests a typosquat-style impersonation of the popular WhatsApp library Baileys. No CVEs are assigned; no fixed versions exist.
Do: Remove @realvare/based and @realvare/baileys from all projects and lockfiles immediately; Rotate all secrets, keys, tokens and credentials stored on affected machines, from a clean computer; Rebuild/reimage compromised machines; do not assume package removal removed the malware; Audit install and CI logs for any use of these packages and check for persistence or exfiltration; Block the @realvare scope in npm policy and prefer the legitimate upstream packages

### [high] w002yardprobe RubyGems: gem runs code during YARD doc builds and sends host details to webhook.site
https://helix.ml/threat-watch/i/yard-doc-exfil-probe-w002yardprobe-rubygems-malicious-gem-exfiltrates-host-info-during-doc-generation-no-cve · Supply chain · no-fix-needed · since 2026-11-03
The RubyGems gem w002yardprobe, versions 0.0.4 and 0.0.5, was flagged by Amazon Inspector and ingested by OpenSSF into OSV as MAL-2026-18599, with GitHub advisory GHSA-cv4q-gcjm-77v8. Its .yardopts file loads a script with YARD's --load option, so the script runs whenever YARD generates documentation for the gem, whether locally, in CI, or on a doc-hosting service. The script collects the hostname, working directory, UID and Ruby version and posts them to a hardcoded webhook.site collector. It also rewrites lib/w002yardprobe.rb in place and writes sentinel files (W002SCRIPT_RAN.txt, W002EGRESS_OK.txt) into the build directory. The gem's RubyGems author is 'w002-research', and its summary calls it a minimal probe for verifying YARD doc generation on documentation hosts; the GitHub homepage it links does not resolve. That self-description does not make the code benign: any developer whose documentation build loads the gem runs it. No patched version exists. Remove the gem, and treat all versions as suspect, since 0.0.1 to 0.0.3 are not in the advisory and were not inspected.
Do: Remove w002yardprobe from all Gemfiles, lockfiles and dependency caches; do not use any version. Only 0.0.4 and 0.0.5 are in the advisory; 0.0.1 to 0.0.3 (published 2026-11-03) were not inspected and should be treated as suspect; Audit CI runners, developer workstations and doc-build hosts that may have generated docs for the gem for sentinel files W002SCRIPT_RAN.txt / W002EGRESS_OK.txt and modifications to lib/w002yardprobe.rb; Block egress to webhook.site/97fa3c6a-3fad-4d2d-8312-15dc37e41e66 and review any outbound requests to webhook.site from build systems; Review YARD/doc-generation pipelines for --load directives in .yardopts from untrusted gems and sandbox doc builds; run YARD on third-party gems with --no-yardopts where possible; Rotate credentials/secrets present on affected build hosts if compromise indicators are found

### [critical] @ai-ecoverse/slicc-windows-amd64 npm package is malware — full machine compromise for installers of v1.46.4
https://helix.ml/threat-watch/i/ai-ecoverse-slicc-windows-amd64-npm-package-is-malware-full-machine-compromise-for-installers-of-v1-46-4 · Supply chain · no-fix-needed · since 2026-11-04
GitHub's malware advisory database flagged the npm package @ai-ecoverse/slicc-windows-amd64 version 1.46.4 as embedded malicious code (CWE-506), published 2026-11-04. The advisory states any computer with the package installed or running should be considered fully compromised, implying the malware grants attackers full control of the host. No patched version exists; the package has no known source code. With roughly 21,000 monthly downloads, exposure is meaningful across developer and CI environments that installed this version. Remediation is removal of the package plus rotation of all secrets and keys from a clean machine, since uninstalling cannot guarantee removal of attacker persistence.
Do: Treat any machine with @ai-ecoverse/slicc-windows-amd64@1.46.4 installed as fully compromised; isolate and rebuild it; Rotate all secrets, keys, tokens and credentials stored on affected machines immediately, from a clean computer; Remove the package and audit for persistence mechanisms, as removal may not eliminate all malicious software; Check npm lockfiles and CI pipelines for the package and block/flag it in dependency scanning; Review logs for signs of attacker activity following installation

### [critical] screenshot-desktop npm package 1.16.0 is malware — full machine compromise, no patched version
https://helix.ml/threat-watch/i/screenshot-desktop-npm-package-1-16-0-is-malware-full-machine-compromise-no-patched-version · Supply chain · no-fix-needed · since 2026-11-04
GitHub published advisory GHSA-q2mc-9hgr-vmx2 on 2026-11-04 flagging version 1.16.0 of the popular npm package screenshot-desktop as malware (CWE-506, embedded malicious code). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. No patched version exists and the advisory is not accepting fixes. The package has ~217K monthly downloads, 215 dependent repositories, and 502 GitHub stars, so downstream projects and CI environments may be affected. Removal of the package does not guarantee removal of all malicious software planted during installation. Organisations should treat affected hosts as breached and rotate all secrets from a clean machine.
Do: Remove screenshot-desktop 1.16.0 from all projects, lockfiles and CI pipelines; Rotate all secrets, keys and credentials stored on or accessible from affected machines, using a clean computer; Rebuild/reimage affected machines; do not assume uninstalling the package removed the malware; Audit dependent repositories and downstream builds for use of the package and signs of compromise; Pin to a known-clean version or replace the package with an alternative

### [critical] Dependency-confusion probe: @signals-notebook/annotation-editor npm package leaks installer identity via preinstall script
https://helix.ml/threat-watch/i/dependency-confusion-probe-signals-notebook-annotation-editor-npm-package-leaks-installer-identity-via-preinstall-script · Supply chain · no-fix-needed · since 2026-11-04
OpenSSF's malicious-packages database flagged version 2.2.60-630109c of the npm package @signals-notebook/annotation-editor as malware, published to the GitHub Advisory Database on 2026-11-04 (GHSA-546q-f34h-xwmx, CWE-506). The package's preinstall script runs automatically on npm install, collecting the output of `id` — the installing user's identity and group memberships — base64-encoding it, and exfiltrating it via curl to a request-bin host. This is a classic dependency-confusion probe pattern, meaning any developer machine, CI runner, or build environment that installs the package leaks data to the attacker. There are no patched versions; the package is malware and should be removed entirely. Anyone who installed this version should treat the installing user's identity as disclosed and audit for further compromise.
Do: Remove @signals-notebook/annotation-editor 2.2.60-630109c from all dependency trees and lockfiles immediately; Audit install logs and CI history to identify machines that installed the package; Treat the `id` output (usernames, group memberships) of affected machines as leaked to an unknown third party; Block the request-bin exfiltration host at network egress and check proxy logs for callbacks; Pin internal dependency-confusion protections (scoped registry, allowlists) and scan for other typosquatted or probe packages

### [critical] babyyodaa (npm): malicious package runs reverse-shell script on install (no CVE)
https://helix.ml/threat-watch/i/babyyodaa-npm-malicious-package-runs-reverse-shell-script-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-04
The npm package babyyodaa version 1.1.0 was identified as malicious and published to the GitHub Advisory Database (GHSA-x23x-7rrv-ffw6) on 2026-11-04, credited to OpenSSF's malicious-packages database. The package's preinstall script marks a bundled shell script as executable and runs it during installation; the script contains a reverse-shell pattern that gives a remote attacker a shell on the installing machine. Any developer or CI system that installed babyyodaa 1.1.0 is potentially compromised. There are no patched versions — the package is malware and should not be used. Reach appears limited (~3 downloads/month, 3 GitHub stars), but any installation constitutes full machine compromise. Removal of the package does not undo the compromise; incident response is required for anyone who installed it.
Do: Check whether babyyodaa 1.1.0 (tarball SHA-256 8321ef8b36b40d9a5b5ba649e9ad4ec3bcbe18a9a484075c5e8e5e872ec0db0b) was installed in any developer machine or CI environment and treat those hosts as compromised; If installed, isolate and rebuild affected machines and rotate all credentials, tokens, and SSH keys accessible from them; Audit install logs and lockfiles for the package and block it in registry allowlists/proxies; Review CI pipelines for use of the package and rotate CI secrets; Monitor for reverse-shell/network beacon indicators on potentially affected hosts

### [critical] et_phone_home (npm): malicious postinstall script phones home to bare IPv4 host on every install
https://helix.ml/threat-watch/i/et-phone-home-npm-malicious-postinstall-script-phones-home-to-bare-ipv4-host-on-every-install · Supply chain · no-fix-needed · since 2026-11-04
OpenSSF flagged the npm package et_phone_home as malicious (GHSA-22c9-84j8-wjjv, MAL-2026-18607). Version 0.0.5 contains a postinstall script that runs automatically on install and uses wget to fetch a path from a bare IPv4 address, contacting a remote host from every machine that installs the package. The package has no legitimate source code, no patched versions, and has been removed/flagged as malware (CWE-506). Reach is limited (~36 downloads/month, 1 dependent repo), but any developer or CI machine that installed 0.0.5 executed the malicious code and reached out to attacker infrastructure. There is no fix; the only remediation is removal and host triage.
Do: Check lockfiles and CI logs for et_phone_home@0.0.5 and remove it from all dependency trees; Audit machines and CI runners that installed it: inspect for follow-on wget-fetched payloads, persistence, and outbound connections to the bare IPv4 host; Rotate credentials and secrets accessible from affected build environments; Block the contacted IP at network egress and hunt logs for prior connections; Rebuild affected artifacts from clean environments

### [critical] gugodapis npm package: dropper downloads and executes remote Windows batch payload via child_process.exec (no CVE)
https://helix.ml/threat-watch/i/gugodapis-npm-package-dropper-downloads-and-executes-remote-windows-batch-payload-via-child-process-exec-no-cve · Supply chain · no-fix-needed · since 2026-11-04
OpenSSF reported the npm package gugodapis (version 1.0.0) as malicious code, published to the GitHub Advisory Database on 2026-11-04 (GHSA-8f66-hgpp-j732). The package is a dropper: at run time it downloads a Windows batch file from a remote URL into the system temporary directory and executes it with child_process.exec. Because the payload is fetched rather than shipped, the code actually executed is fully controlled by the remote host and can change at any time. No patched versions exist; the package should be treated as compromised and removed. Reach appears limited (~20 downloads/month), but any environment that installed and ran it may have executed arbitrary attacker code, particularly on Windows systems.
Do: Remove gugodapis from all dependencies and lockfiles and rebuild from trusted sources; Audit systems where the package ran for signs of batch-file execution in temp directories and child_process use; Rotate credentials and secrets accessible from affected machines; Block the package name in npm registries/proxies and monitor for re-uploads under new versions or names

### [critical] Dependency confusion: @atfm npm packages exfiltrate builder host info to callback.m0chan.co.uk on install
https://helix.ml/threat-watch/i/dependency-confusion-atfm-npm-packages-exfiltrate-builder-host-info-to-callback-m0chan-co-uk-on-install · Supply chain · no-fix-needed · since 2026-11-04
Two npm packages, @atfm/atfm-material-ui and @atfm/utils, both at version 99.99.99, were published as dependency-confusion malware. The inflated version numbers ensure that builds resolving internal @atfm-scoped packages pick the public malicious ones. Their preinstall scripts run on npm install, base64-encoding the installing user, hostname, working directory and package name, then exfiltrating the data via an HTTPS GET to a subdomain of callback.m0chan.co.uk and via a DNS lookup with the encoded package name as a subdomain label. The same script appears in other packages in the campaign calling back to the same domain. Any CI or developer machine that installed these packages leaked host information. Both packages have been removed from npm; there are no patched versions, so remediation means removing the packages and auditing installs.
Do: Audit npm install logs and lockfiles for @atfm/atfm-material-ui or @atfm/utils at 99.99.99 and any installs resolving to callback.m0chan.co.uk; Treat any machine or CI runner that installed them as compromised; investigate and rotate credentials used there; Block the domain callback.m0chan.co.uk and its subdomains in DNS and egress filtering; Configure npm scope mapping (.npmrc) so internal @atfm packages only resolve from the private registry; Enable npm audit and registry allowlists / ignore-scripts to prevent preinstall execution from unknown packages

### [critical] brida-frida-hooks (RubyGems): malicious gem exfiltrates system data to attacker OASTify server on gem install
https://helix.ml/threat-watch/i/brida-frida-hooks-rubygems-malicious-gem-exfiltrates-system-data-to-attacker-oastify-server-on-gem-install · Supply chain · no-fix-needed · since 2026-11-04
The RubyGems package brida-frida-hooks version 1.0.1 was identified as malware (GHSA-vqw2-j6mj-82hq, MAL-2026-18598, published 2026-11-04). The gem declares an extension script in its gemspec that executes automatically during gem install. The script collects installer identity and local system data — current working directory, home directory, hostname, username, and contents of /etc/resolv.conf, /etc/passwd, and /etc/hosts — and POSTs it over TLS via a raw TCPSocket to a hardcoded Burp Collaborator subdomain (bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com) on port 443. The exfiltration is unrelated to the gem's stated 'simple demo' purpose. Anyone who installed version 1.0.1 had system data exfiltrated. No patched version exists; the package should be treated as compromised and removed.
Do: Check whether brida-frida-hooks 1.0.1 was installed on any system; remove it and purge it from Gemfile.lock and caches; Treat collected data (usernames, hostnames, /etc/passwd, /etc/hosts, DNS config) as exposed and review for follow-on targeting; Audit systems where the gem was installed for further compromise or persistence; Block the OASTify callback domain bjyhowqsve7p6i4fflj14mly8pel2bq0.oastify.com at egress; Prefer pinned, vetted dependencies and scan gemspecs for install-time extension scripts

### [critical] mocha-ui-themes (npm): malicious package compromises any machine where it is installed
https://helix.ml/threat-watch/i/mocha-ui-themes-npm-malicious-package-compromises-any-machine-where-it-is-installed · Supply chain · no-fix-needed · since 2026-11-04
GitHub published a malware advisory (GHSA-8wh7-jcx5-hv37) for the npm package mocha-ui-themes, flagged as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of all malicious software it deployed. Any developer, CI system, or end user who installed the package is affected. There is no fix — remediation is removal plus full incident response including secret rotation and system rebuild.
Do: Remove mocha-ui-themes from all projects, lockfiles, and CI pipelines; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild or reimage affected machines; do not assume removal of the package clears the compromise; Audit npm dependencies for the package and block/reinstall from trusted sources; Review logs and network activity for signs of attacker access following installation

### [critical] Malware in yzx-npm npm package — versions 1.0.0 and 1.0.1 fully compromise installed machines; no clean version exists
https://helix.ml/threat-watch/i/malware-in-yzx-npm-npm-package-versions-1-0-0-and-1-0-1-fully-compromise-installed-machines-no-clean-version-exists · Supply chain · no-fix-needed · since 2026-11-04
GitHub's malware advisory database (GHSA-2mqp-mxm3-j2fh, published 2026-11-04) flags the npm package yzx-npm as containing embedded malicious code (CWE-506). Versions 1.0.0 and 1.0.1 are affected and there are no patched versions — the package should not be used at all. GitHub states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets and keys stored on the machine. Removal of the package does not guarantee removal of all malicious software it deployed. All developers or CI systems that installed yzx-npm are affected; no fixed release is available, so remediation is incident response rather than an upgrade.
Do: Treat any machine that installed or ran yzx-npm as fully compromised; isolate and rebuild it; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Remove the yzx-npm package from all projects, lockfiles and CI pipelines and audit for persistence mechanisms it may have installed; Check npm audit logs and dependency trees for other machines or environments that pulled the package; Block yzx-npm in internal registries and dependency firewall policies

### [critical] Jito tip-package typosquat malware: malicious npm packages jito-bundle-* fully compromise hosts
https://helix.ml/threat-watch/i/jito-tip-package-typosquat-malware-malicious-npm-packages-jito-bundle-fully-compromise-hosts · Supply chain · no-fix-needed · since 2026-11-04
On 2026-11-04 GitHub published four malware advisories (GHSA-f2jv-xgx9-pxr8, GHSA-f985-77gc-37cx, GHSA-wm3m-jxgh-45rj, GHSA-27pm-fpm8-v8wm) for npm packages jito-bundle-jitotip, jito-bundle-tip-7, @touchkey0111/jito-bundle and jito-bundle-jito-tip7. All versions (>= 0) are flagged as embedded malicious code (CWE-506) with no patched versions; the packages appear to be typosquats of Jito's bundling/tip tooling. GitHub states any machine with these packages installed or running should be considered fully compromised, implying attacker control and likely secret/key theft. Download volumes are small (8-19/month each), limiting reach, but any install is treated as active compromise. Removal alone is not guaranteed to eradicate the malware; there is no fix beyond avoiding the packages.
Do: Treat any machine with these packages installed as fully compromised; isolate it immediately; Rotate all secrets, keys, wallets and credentials stored on affected machines from a clean computer; Remove the packages and rebuild/reimage affected systems rather than trusting uninstall; Audit dependency locks and CI caches for the package names and block them in registries/proxies; Check npm audit logs and download history for exposure to these packages

### [medium] Fake-download trojanized Inno installer campaign: Windows users — monetization payloads via cracked-software lures (no CVE)
https://helix.ml/threat-watch/i/fake-download-trojanized-inno-installer-campaign-windows-users-monetization-payloads-via-cracked-software-lures-no-cve · Supply chain · no-fix-needed · since 2026-11-03
Microsoft Threat Intelligence reported a fake-download campaign delivering trojanized Inno Setup-style installers lured as cracked software, games, Roblox executors, activators, and utilities. Installers stage numbered eld*/set_* executables under %TEMP%\is-*.tmp\, contact rotating infrastructure via a d=inno / r=offer_execution callback, and silently install monetization payloads: WorldProxyPool (traffic proxying with SYSTEM scheduled tasks), CharityEngine/BOINC (distributed computing), and Advanced Windows/Windows Manager adware-style utilities. Affected devices become monetized assets without informed consent. No CVE; mitigation relies on avoiding untrusted download sources, enabling PUA protection in Microsoft Defender, and monitoring for unexpected installs and persistence. Reported 2026-11-03.
Do: Block and warn users against downloading cracked software, activators, and unofficial utilities; Enable potentially unwanted application (PUA) protection in Microsoft Defender and enforce SmartScreen; Hunt for %TEMP%\is-*.tmp\ runners, eld*.exe/set_*.exe stages, and d=inno/r=offer_execution callbacks; Audit for unexpected scheduled tasks (SYSTEM-level watchdog/updater) and unfamiliar installed software like BOINC or proxy agents; Review Microsoft's published IOCs and advanced hunting queries and map detections to the provided MITRE ATT&CK techniques

### [critical] jailbreak-code (npm): malicious package compromises any machine where it is installed (no CVE)
https://helix.ml/threat-watch/i/jailbreak-code-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub's malware advisory database published GHSA-fmpq-536x-fhwq on 2026-11-03 flagging the npm package jailbreak-code as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists; the package has no known source code repository. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, so removal alone may not eliminate the malicious software. Any developer, CI system, or end user that installed jailbreak-code from npm is affected. There is no fix; remediation consists of removing the package and rotating all secrets and keys from a clean machine.
Do: Treat any machine with jailbreak-code installed as fully compromised; rotate all secrets and keys immediately from a different, clean computer; Audit npm lockfiles, CI caches, and developer machines for jailbreak-code and remove it; Rebuild affected systems from trusted images rather than assuming removal is sufficient; Review logs and credentials for signs of exfiltration or unauthorized access; Block the package in internal registries and dependency-scanning tooling

### [critical] bandkit (npm) — malicious package compromises any machine where it is installed; no safe version exists
https://helix.ml/threat-watch/i/bandkit-npm-malicious-package-compromises-any-machine-where-it-is-installed-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-03
GitHub's malware advisory database published GHSA-v69f-q3vh-9qcf on 2026-11-03 flagging the npm package 'bandkit' as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists, meaning the package itself is malware rather than a compromised legitimate library. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially given to an outside entity, and that removal of the package does not guarantee removal of all malicious software. All developers and CI systems that installed bandkit are affected; secrets and keys on those machines must be treated as stolen and rotated from a clean computer.
Do: Immediately stop using and remove the bandkit package from all projects, lockfiles and CI pipelines; Treat every machine that installed or ran bandkit as fully compromised; rotate all secrets, keys, tokens and credentials stored there from a clean computer; Rebuild affected machines/environments from trusted images rather than trusting post-removal cleanup; Audit npm dependency trees and CI logs for bandkit installs and any resulting suspicious activity; Block the package name in internal registries and dependency firewall/proxy policies

### [critical] arbkit npm package malware — full compromise of installed machines; rotate all secrets and keys
https://helix.ml/threat-watch/i/arbkit-npm-package-malware-full-compromise-of-installed-machines-rotate-all-secrets-and-keys · Supply chain · no-fix-needed · since 2026-11-03
GitHub's malware advisory database published GHSA-8vwq-527w-6hcm on 2026-11-03 flagging the npm package arbkit as embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists, so any installation is considered compromised. The advisory states that any computer with the package installed or running should be considered fully compromised by an outside entity, and all secrets and keys stored on such machines must be rotated immediately from a different, clean computer. The package sees roughly 2,974 downloads per month, so downstream projects and CI environments that pulled it are at risk. Removal of the package is advised but may not eliminate all malicious software planted during installation. There is no fix; the only safe action is removal plus full credential rotation and host remediation or rebuild.
Do: Treat every machine with arbkit installed as fully compromised; rotate all secrets, keys, and tokens from a clean computer immediately; Remove arbkit from all projects, lockfiles, and CI pipelines and audit for persistence left behind; Rebuild or thoroughly remediate affected hosts; do not assume removal of the package cleans the system; Audit logs and network egress for signs of exfiltration or attacker activity since installation; Block future installs of arbkit and review dependency trees for other compromised packages

### [critical] Malicious npm packages passwordcracker and passwordcrackv2 — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-packages-passwordcracker-and-passwordcrackv2-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-03
On 2026-11-03 GitHub published malware advisories GHSA-5crh-hjrq-j9p4 and GHSA-pqwv-7rr5-v32f for two npm packages, passwordcracker and passwordcrackv2. Every version (>= 0) is flagged as embedded malicious code (CWE-506) with no patched versions and no known source code repository. GitHub's guidance states that any computer with these packages installed or running should be considered fully compromised, implying the code grants outside actors control of the host, enabling theft of secrets, keys and credentials. Any developer or CI environment that installed either package is affected. There is no fix; remediation requires removing the package and rotating all secrets from a clean machine.
Do: Remove passwordcracker and passwordcrackv2 from all projects, lockfiles and CI caches; Treat affected machines and build agents as fully compromised; rebuild them from clean images; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected systems, using a clean computer; Audit logs and network traffic for signs of exfiltration or attacker access; Block both package names in internal registries and dependency firewall policies

### [critical] Malicious npm package idlive-face-capture-web-development — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-idlive-face-capture-web-development-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub published a malware advisory (GHSA-84cj-67gm-jqc5, CWE-506 Embedded Malicious Code) for the npm package idlive-face-capture-web-development on 2026-11-03. The package, which appears to impersonate a legitimate face-capture SDK, is classified as fully malicious: any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. All versions (>= 0) are affected and no patched version exists. Exploitation is presumed wherever the package was installed; removal alone cannot be guaranteed to eliminate the malicious software. Affected organisations must treat secrets and keys on impacted machines as stolen and rotate them from a clean computer.
Do: Treat any machine with the package installed as fully compromised; rotate all secrets and keys stored there immediately, from a different clean computer; Remove the package and rebuild/reimage affected systems; do not assume removal eliminates the malware; Audit dependency lockfiles and CI/CD environments for the package and any installs of it; Review access logs and credentials for signs of exfiltration or attacker access; Block the package name in internal registries and dependency scanning

### [critical] Malicious npm package xapi-lib — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-xapi-lib-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-03
GitHub published a malware advisory (GHSA-wm6w-9vgq-gw26, CWE-506 Embedded Malicious Code) for the npm package xapi-lib on 2026-11-03. Every published version (>= 0) is affected and no patched version exists; the package is considered malware rather than a vulnerable library. Any computer where the package is installed or running should be treated as fully compromised, with attacker control implying potential theft of secrets, keys and credentials and persistence beyond simple package removal. No exploitation details, campaign name, or attribution are given. Organisations with the package in their dependency tree should treat associated hosts as breached, rotate all credentials from a clean machine, and remove the package and any persistence it established.
Do: Treat any machine with xapi-lib installed or running as fully compromised; Rotate all secrets, keys and credentials stored on affected machines, from a clean computer; Remove the package and hunt for persistence or additional malicious software it may have installed; Audit dependency trees and CI/CD for xapi-lib and block/rebuild from clean images

### [critical] Malicious npm package buyerdashboard — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-buyerdashboard-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub's malware advisory database published GHSA-gg3j-f9ff-vx42 on 2026-11-03 flagging the npm package buyerdashboard as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists — the package itself is the attack. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside actor, exposing secrets, keys and credentials. There is no remediation via upgrade; the only action is removal plus full credential rotation and system rebuild, since removal cannot guarantee all implanted malware is gone. Any developer or CI environment that installed buyerdashboard is affected.
Do: Rotate all secrets, keys and credentials stored on any machine where buyerdashboard was installed, using a clean machine; Remove the package and rebuild/reimage affected machines; do not trust the existing environment; Audit install logs, CI caches and lockfiles for buyerdashboard and block it in registries/proxies; Review access logs and network activity for signs of attacker control; Notify downstream users if the package entered your dependency tree

### [critical] Malicious npm package monkey-tags-ip — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-monkey-tags-ip-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub's advisory database published a malware advisory (GHSA-97j9-4wmq-rgfv) for the npm package monkey-tags-ip on 2026-11-03. The package contains embedded malicious code (CWE-506) and every published version (>= 0) is affected, with no patched version available. GitHub warns that any computer with the package installed or running should be considered fully compromised, as full control may have been handed to an outside entity; removal of the package does not guarantee removal of all malicious software. Developers and CI systems that installed the package should treat stored secrets and keys as stolen. No fix exists; remediation is removal plus credential rotation and system rebuild.
Do: Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer; Remove monkey-tags-ip from all projects, lockfiles, and caches; Rebuild or reimage affected machines; do not assume removal of the package cleans the system; Audit logs and network traffic for signs of attacker access or exfiltration; Block the package in npm/CI dependency allowlists and scan dependency trees for it

### [critical] @mntv-analysis npm packages (@mntv-analysis/ui, ui-components, workspaces-components) — malware, full host compromise
https://helix.ml/threat-watch/i/mntv-analysis-npm-packages-mntv-analysis-ui-ui-components-workspaces-components-malware-full-host-compromise · Supply chain · no-fix-needed · since 2026-11-03
On 2026-11-03 GitHub published three malware advisories (GHSA-rrrh-xwrx-pmx6, GHSA-5vh8-xg47-5c3q, GHSA-f672-cw2f-69wr) covering every published version of three npm packages under the @mntv-analysis scope: ui, ui-components, and workspaces-components. The packages contain embedded malicious code (CWE-506) and no safe version exists; any machine where they were installed or executed must be considered fully compromised, with potential theft of secrets, keys, and credentials by an outside attacker. No patched versions are available and no source code is known; removal of the packages does not guarantee removal of attacker persistence. All npm consumers of these packages are affected.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine that installed or ran these packages, using a clean machine; Remove the packages from all projects and lockfiles and block the @mntv-analysis npm scope; Rebuild affected machines or at minimum hunt for persistence, as removal does not guarantee a clean system; Audit CI/CD and developer environments for exposure and review npm audit logs for installs of these packages

### [critical] Malicious npm package web-pixels-manager — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-web-pixels-manager-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub's malware advisory database published GHSA-v6gx-6p2r-f6pp on 2026-11-03 flagging the npm package web-pixels-manager as embedded malicious code (CWE-506). All published versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity, so removing the package does not guarantee removal of all malicious software. Any developer or CI environment that installed the package is affected; secrets and keys stored on those machines are at risk. There is no fix — remediation is removal plus credential rotation from a clean machine.
Do: Treat any machine where web-pixels-manager was installed or run as fully compromised; Rotate all secrets, keys, and credentials stored on affected machines immediately, from a different clean computer; Remove the package from projects, lockfiles, and CI pipelines and audit for persistence mechanisms; Rebuild affected systems from clean images where feasible; Review npm install logs and dependency trees for other typosquat or malicious packages

### [critical] Malicious npm package @user-interface-common/common-styles — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-user-interface-common-common-styles-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub published advisory GHSA-75r2-hqv3-4f7q on 2026-11-03 flagging the npm package @user-interface-common/common-styles as malware (CWE-506, embedded malicious code). All published versions (>= 0) are affected and no patched version exists. The advisory states any computer with the package installed or running should be considered fully compromised, implying attackers may have obtained full control, including access to secrets and keys. Anyone who installed the package—directly or as a transitive dependency—is affected. Removal of the package alone is not guaranteed to eliminate the malicious software. No fix is available; remediation is incident response, not upgrading.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine; Remove the package and rebuild/reimage affected systems; do not assume removal fully cleans the machine; Audit dependency lockfiles and CI environments for the package and any persistence it may have created; Block the package name in internal registries and dependency scanning

### [critical] Malicious npm package print-hello-world-test-temp — full system compromise on install (GHSA-jrrx-r9c6-3mhv)
https://helix.ml/threat-watch/i/malicious-npm-package-print-hello-world-test-temp-full-system-compromise-on-install-ghsa-jrrx-r9c6-3mhv · Supply chain · no-fix-needed · since 2026-11-03
GitHub's advisory database published a malware advisory (GHSA-jrrx-r9c6-3mhv, CWE-506 Embedded Malicious Code) for the npm package print-hello-world-test-temp on 2026-11-03. Every published version (>= 0) is affected and no patched version exists, so any install of the package is malicious. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, meaning attackers may have obtained full control, including access to secrets and keys stored on the machine. No source code repository is known for the package. Any developer or CI environment that installed it is affected; removal of the package alone cannot be assumed to remove all malicious software.
Do: Rotate all secrets and keys stored on any machine where the package was installed, using a different, clean computer; Rebuild or reimage affected machines; do not assume uninstalling the package removes the malware; Audit systems and CI logs for installation of print-hello-world-test-temp and any indicators of compromise; Block the package in npm registries, lockfiles, and dependency firewalls

### [critical] Malicious npm package txnforge — full host compromise; no safe version exists
https://helix.ml/threat-watch/i/malicious-npm-package-txnforge-full-host-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-03
GitHub published advisory GHSA-qjw2-5743-xhp4 on 2026-11-03 flagging the npm package txnforge as malware (CWE-506, embedded malicious code). Every published version (>= 0) is affected and there are no patched versions, so any installation should be treated as a full compromise of the host machine with possible attacker control and exfiltration of secrets and keys. The advisory does not name a distribution vector, campaign, or specific victim organisations. Remediation requires removing the package, rotating all secrets and keys from a clean machine, and rebuilding affected hosts, since removal alone cannot guarantee the malware is eradicated.
Do: Treat any machine where txnforge was installed or run as fully compromised; isolate it; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer; Remove txnforge from all projects and lockfiles and audit for other signs of persistence; Rebuild/reimage affected hosts rather than trusting cleanup; Audit npm dependencies and CI caches for txnforge and block its installation

### [critical] npm typosquat malware wave: bznio5, v36sl2, rtvu6h, ll3zea — full machine compromise on install
https://helix.ml/threat-watch/i/npm-typosquat-malware-wave-bznio5-v36sl2-rtvu6h-ll3zea-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-03
On 2026-11-03 GitHub added four malware advisories for npm packages bznio5, v36sl2, rtvu6h and ll3zea, each flagged CWE-506 embedded malicious code with all versions (>=0) affected and no patched versions. The advisories state any computer with these packages installed or running should be considered fully compromised, with attacker control implying secret and key theft; removal of the package does not guarantee removal of the malicious software. Download volumes are low (5-17 per month), suggesting typosquat-style or low-spread malicious publications rather than a wide campaign, but any install grants full machine compromise. No fix exists; remediation is removal plus credential rotation from a clean machine.
Do: Check lockfiles and installed node_modules for bznio5, v36sl2, rtvu6h or ll3zea and remove them; Treat any machine where they ran as compromised: rotate all secrets, keys, tokens and credentials from a clean machine; Rebuild affected systems from trusted images and audit for persistence; Block the package names in internal registries/proxies and alert developers

### [critical] @shein-risk/si_verify npm malware — full host compromise for anyone installing the package (no CVE)
https://helix.ml/threat-watch/i/shein-risk-si-verify-npm-malware-full-host-compromise-for-anyone-installing-the-package-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub published a malware advisory (GHSA-cj86-h5rm-f7jj, CWE-506 Embedded Malicious Code) for the npm package @shein-risk/si_verify, which receives roughly 486 downloads per month. All versions (>= 0) are affected and no patched version exists; the package has no known source code. The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity — implying secret and key theft. Removal of the package does not guarantee removal of all malicious software it deployed. Any developer or CI environment that installed it is affected; there is no fix beyond removal and remediation of the compromised host.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine; Remove @shein-risk/si_verify from all projects, lockfiles, and CI pipelines and audit for persistence/backdoors on affected hosts; Check npm lockfiles and dependency trees for the package and block it in dependency firewalls/allowlists; Rebuild affected machines from trusted images if compromise is suspected

### [critical] Malicious npm 'game hack generator' packages — full machine compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-game-hack-generator-packages-full-machine-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub published four malware advisories on 2026-11-03 for npm packages posing as game-hack/resource generators (CarX Drift Racing, My Talking Angela, Rope Hero, App Cloner Premium). All versions are flagged as embedded malicious code (CWE-506) with no patched versions; GitHub states any machine with the package installed or running should be considered fully compromised, with attacker control implying possible persistence beyond simple removal. Download volumes are small (2-6/month), but anyone who installed these packages may have had secrets, keys and credentials exfiltrated. Remediation is removal plus credential rotation from a clean machine.
Do: Remove the packages and treat affected machines as fully compromised; Rotate all secrets, keys and credentials stored on affected machines, from a clean computer; Audit affected systems for persistence and reinstall from trusted images if compromise is suspected; Check CI/CD and developer machines for these package names in lockfiles and dependency trees; Block/quarantine the package names in registry proxies and dependency scanning

### [critical] npm typosquat malware wave: k7nhgj, 9ct8bi, winjb6, 1b67v5 — full machine compromise on install
https://helix.ml/threat-watch/i/npm-typosquat-malware-wave-k7nhgj-9ct8bi-winjb6-1b67v5-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-03
On 2026-11-03 GitHub added four malware advisories for npm packages k7nhgj (11 downloads/month), 9ct8bi (18/month), winjb6 (5/month) and 1b67v5 (21/month). All versions (>= 0) are flagged as embedded malicious code (CWE-506) with no patched versions and no known source code; the packages appear to be junk-named typosquats or throwaway malicious publishes. GitHub's standard malware wording states any machine with the package installed or running should be considered fully compromised, with attacker access to secrets and keys and no guarantee removal cleans the system. Impact is limited by very low download counts, but any install grants full control to an outside entity. No fix exists — remediation is removal plus credential rotation and host rebuild.
Do: Check lockfiles and installed node_modules for k7nhgj, 9ct8bi, winjb6 or 1b67v5 and remove them; Treat any machine where they ran as compromised: rotate all secrets, keys, tokens and credentials from a clean machine; Rebuild/reimage affected hosts rather than trusting cleanup; Block the package names in internal registries and CI dependency scanning; Audit npm install logs for other suspicious low-download junk-named packages

### [critical] ib3rwn npm package is malware — full machine compromise on install
https://helix.ml/threat-watch/i/ib3rwn-npm-package-is-malware-full-machine-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-03
GitHub published a malware advisory (GHSA-gm4c-56vq-fvc9) for the npm package ib3rwn, flagged as CWE-506 embedded malicious code. All versions (>= 0) are affected and there are no patched versions — the package itself is the malware. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, with attacker control potentially persisting even after removal. Reach appears limited (~7 downloads/month), but any developer or CI environment that installed it is at risk of secret and key theft. No fix exists; remediation is removal plus credential rotation from a clean machine.
Do: Remove the ib3rwn package from all machines, builds and CI pipelines; Rotate all secrets, keys and credentials stored on affected machines, using a clean computer; Rebuild/reimage compromised machines; audit for persistence mechanisms; Audit dependency lockfiles and history for any installs of ib3rwn; Block the package in registry proxies/allowlists

### [critical] Malicious npm packages @lynnidoffc/baileys and @lynnidoffc/libsignal-node — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-packages-lynnidoffc-baileys-and-lynnidoffc-libsignal-node-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-03
On 2026-11-03 GitHub published two malware advisories (GHSA-p6q5-8756-2mv7, GHSA-364q-2fx8-p97q) for the npm packages @lynnidoffc/baileys and @lynnidoffc/libsignal-node, which appear to be typosquat-style malicious imitations of the popular Baileys WhatsApp library and its libsignal dependency. All versions (>= 0) are affected, with no patched versions available. The packages contain embedded malicious code (CWE-506); GitHub warns that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. Reach appears limited (~82 downloads/month for baileys). Removal of the package does not guarantee removal of all malicious software. No fix exists; affected machines must be treated as compromised.
Do: Immediately remove @lynnidoffc/baileys and @lynnidoffc/libsignal-node from all systems and dependency trees; Rotate all secrets, keys, and credentials stored on affected machines from a clean computer; Rebuild/reimage affected machines; do not assume removal of the package removed the malware; Audit install and CI logs for any use of these packages and check for persistence mechanisms; Block the packages and publisher scope in npm registries and dependency firewalls

### [critical] Malicious npm packages @vanzxy/baileys and @vanzxy/nusa fully compromise installed machines
https://helix.ml/threat-watch/i/malicious-npm-packages-vanzxy-baileys-and-vanzxy-nusa-fully-compromise-installed-machines · Supply chain · no-fix-needed · since 2026-11-03
GitHub Advisory Database published two malware advisories on 2026-11-03 for npm packages @vanzxy/baileys (GHSA-p29j-8jqp-jx9c, ~6,245 downloads/month, 2 GitHub stars) and @vanzxy/nusa (GHSA-32w9-v5cw-xh96, ~66 downloads/month). Both are classified CWE-506 Embedded Malicious Code, affect all versions (>= 0), and have no patched versions. GitHub warns any computer with the packages installed or running should be considered fully compromised, with full control potentially given to an outside entity, and removal of the package does not guarantee removal of all malicious software. The @vanzxy/baileys name suggests a typosquat-style imitation of the popular Baileys WhatsApp library. All secrets and keys on affected machines are at risk; no fix exists other than removal and remediation.
Do: Immediately stop using and uninstall @vanzxy/baileys and @vanzxy/nusa from all systems and CI environments; Treat affected machines as fully compromised: rotate all secrets, keys, tokens and credentials stored or accessible on them, from a clean machine; Rebuild/reimage affected hosts; package removal alone does not guarantee malware removal; Audit dependency lockfiles and install history for these packages and any related @vanzxy packages; Block the @vanzxy scope in npm registries and internal dependency firewalls

### [critical] Malicious npm package @systemzero/baileys — full compromise of installed machines; rotate all secrets (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-systemzero-baileys-full-compromise-of-installed-machines-rotate-all-secrets-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub's Advisory Database published GHSA-7fxw-7r63-529q on 2026-11-03 flagging the npm package @systemzero/baileys as malware (CWE-506, Embedded Malicious Code). All versions (>= 0) are affected and no patched version exists; the package has no known source code repository and averages ~2,629 downloads per month. GitHub's guidance states that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and removal of the package does not guarantee removal of all malicious software. Any developer or CI environment that installed it should treat stored secrets and keys as stolen. There is no fix; remediation is removal plus credential rotation and host forensics/rebuild.
Do: Rotate all secrets, keys, and credentials stored on any machine where the package was installed, using a clean machine; Remove @systemzero/baileys from all projects and lockfiles and rebuild affected machines from trusted images; Audit systems for persistence and other malicious software left behind after removal; Check npm audit logs/CI for installs of the package and block it in dependency policies

### [high] Reachy Mini robot: five chained flaws give LAN attacker root and control of motors, camera and mic
https://helix.ml/threat-watch/i/reachy-mini-robot-hijack-pollen-robotics-hugging-face-ai-robot-5-chained-cves-allow-unauthenticated-http-takeover-of-mot · Supply chain · partial · since 2026-11-03 · CVE-2026-53605, CVE-2026-55419, CVE-2026-62661, CVE-2026-96455, CVE-2026-96456
JFrog Security Research describes five vulnerabilities in the Reachy Mini robot from Pollen Robotics and Hugging Face, chained into takeover. The HTTP route starts with an unauthenticated app-install endpoint in the reachy_mini daemon (CVE-2026-96455, NVD CVSS 8.8, adjacent network) that runs attacker code through a pip install. A passwordless sudo grant in the Wireless OS image then gives persistent root (CVE-2026-53605, fixed in OS 0.2.4). From there an attacker can drive the motors, camera and microphone. A browser variant relied on permissive CORS and an operator's stored Hugging Face token; later releases restricted CORS and added DNS-rebinding and cross-site request defences. A Bluetooth route chains an unauthenticated file upload (CVE-2026-55419, fixed in 1.8.2), a Bluetooth PIN race (CVE-2026-96456, fixed in 1.12.0) and a Bluetooth path traversal (CVE-2026-62661, no fixed version listed in its advisory when checked). Exposure is the robot's Wi-Fi or LAN reach to daemon port 8000, or Bluetooth radio proximity; no source claims internet exposure. JFrog published a proof-of-concept video. No source reports exploitation in the wild.
Fixed: reachy-mini-os 0.2.4 (CVE-2026-53605); reachy_mini 1.8.2 (CVE-2026-55419); reachy_mini 1.11.0 (CVE-2026-96455, per NVD reference); reachy_mini 1.12.0 (CVE-2026-96456)
Do: Update reachy_mini to 1.12.0 or later (latest release checked: 1.13.0, 2026-10-26) and the Wireless OS image to 0.2.4 or later; JFrog's v1.11.0 advice does not cover the Bluetooth PIN race fixed in 1.12.0; Until updated, block TCP 8000 on the robot's Wi-Fi interface (JFrog's workaround) and keep the robot off shared or untrusted networks; Do not install untrusted apps or Hugging Face Spaces on the robot; the install endpoint is the main attack primitive; Check the Wireless image's sudoers file and narrow any blanket NOPASSWD grant to the commands the daemon needs; Watch GHSA-vg3x-4hxm-3gxm (CVE-2026-62661) for a fixed version; treat Bluetooth command access as open until one is published; Stop using the robot's camera and microphone in sensitive areas until updated and audited

### [critical] Malicious npm package rootaccessxvv-bbmarker — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-rootaccessxvv-bbmarker-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub's advisory database published a malware advisory (GHSA-j3h4-5jwm-6m55) for the npm package rootaccessxvv-bbmarker, classified under CWE-506 (Embedded Malicious Code). Every published version (>= 0) is affected and no patched version exists — the package itself is the malware. Any machine where the package is installed or running must be considered fully compromised, with control potentially handed to an outside entity. All secrets and keys on affected machines are at risk of theft. There is no fix; remediation consists of removing the package and rotating credentials from a clean machine, though removal cannot guarantee elimination of all malicious software planted during installation.
Do: Treat any machine with rootaccessxvv-bbmarker installed as fully compromised; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Remove the package and rebuild/reimage affected systems where possible; Audit dependency trees and lockfiles for the package and block it in registries/CI; Review access logs and network activity for signs of attacker control

### [critical] Malware in nulio-connector: npm package nulio-connector v1.1.16 fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/malware-in-nulio-connector-npm-package-nulio-connector-v1-1-16-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub published advisory GHSA-v25g-rj4q-4q96 on 2026-11-03 flagging npm package nulio-connector version 1.1.16 as malware (CWE-506, embedded malicious code). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated. No patched version exists and no known source code is available, so the only remediation is removal of the package plus incident response on affected hosts. Reach is limited (~1,435 downloads/month), but any installation is treated as active compromise rather than mere exposure.
Do: Remove nulio-connector 1.1.16 from all machines and CI/build environments immediately; Treat affected machines as fully compromised: rotate all secrets, keys, and credentials stored on them from a clean computer; Audit affected hosts for persistence and additional malicious software; rebuilding from known-good images is safer than cleanup; Check dependency trees and lockfiles for the package and block it in registries/proxies

### [high] OverLord stealer: forged commit force-pushed to antd-img-crop GitHub repo steals credentials on build
https://helix.ml/threat-watch/i/overlord-stealer-antd-img-crop-github-repo-hijacked-via-forged-force-pushed-commit-to-drop-credential-stealer-on-npm-run · Supply chain · unpatched · since 2026-11-03
On 2026-10-31 at 15:12 UTC someone using the maintainer's account force-pushed commit 2aa8504 onto main of the antd-img-crop GitHub repository. It replaced the legitimate 4.30.0 commit 9ed87c0c7, which has the same author, date and message, and adds a prebuild hook that runs scripts/prebuild.js on npm run build. The hook fetches a fake deepfake_guard installer, which in turn pulls encrypted second-stage JavaScript whose server is found through a GitLab dead-drop. That stage steals browser passwords and cookies, keychain and keyring secrets, crypto wallets, SSH keys and .env/.npmrc files on macOS, Linux and Windows, and installs a remote-control agent disguised as Google software. SafeDep published the analysis on 2026-11-03. The first public report we found is GitHub issue #329 at 10:16 UTC that day, opened by the account KunalSin9h, which appears to be the SafeDep author (the article links the same handle on LinkedIn; the article itself does not say how the campaign was found). At about 12:30 UTC on 2026-11-03 the forged commit was still the head of main, with no revert and no maintainer reply on the issue. The npm package is not affected by the evidence we could check: its latest version 4.30.0 was published 2026-03-12, its manifest has no prebuild or install script, and no version has been published since. Anyone who clones or builds the GitHub main branch remains exposed until the commit is removed and the account is recovered. No vendor fix exists, so affected build machines need rebuilding and their credentials rotating.
Do: Do not clone, build or install from the antd-img-crop GitHub main branch until the forged commit is removed; the legitimate 4.30.0 commit is 9ed87c0c7. The npm release 4.30.0 predates the compromise, but its tarball was not inspected here; Isolate and rebuild any machine that ran npm run build on the repo's main branch after 2026-10-31; treat all credentials on it as stolen; Rotate SSH keys, npm/Git tokens, browser-saved passwords, wallet seed material and keychain/keyring secrets from clean devices; Hunt for persistence: com.google.UpdateSupporter LaunchDaemon, google-agent.service, GoogleUpdateSupporterNode scheduled task, short-lived SYSTEM tasks (ABES######, CNGS######, CNG??????, WU??????), and buildwithknexus[.]xyz/check_m in macOS login scripts; Block IOCs: icagllmbt[.]space, api.gaganata[.]ink, api.fallgganata[.]ink, api.chestsoi[.]ink, buildwithknexus[.]xyz, gitlab[.]com/drop-indexings/tasks; hash-block commit 2aa850469fa1ff2e2efe8eebdf1e085e4d11212a and prebuild.js 2c09fce2856bcd92b8afea424da0f9daa67bf2d22ceb625af60deaabd3d0573d; Warn developers about fake recruiter/job-portal 'verification' clipboard commands and sideloaded VS Code/Cursor extensions (google-dev-tools.google-update-support); Pin and verify commit hashes / require signed commits with Verified badges before building from upstream repos; the forged commit is unsigned

### [critical] blitzstrike npm package malware — full compromise of installed machines (no CVE)
https://helix.ml/threat-watch/i/blitzstrike-npm-package-malware-full-compromise-of-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub published a malware advisory (GHSA-g8hc-9fqj-qjj6) on 2026-11-03 for the npm package blitzstrike, version 2.4.180, classifying it as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity. The package has roughly 10K monthly downloads and 515 GitHub stars, so exposure is non-trivial. There are no patched versions and no known source code; the advisory states removal of the package cannot guarantee removal of all malicious software it may have installed. Organisations running it must treat secrets and keys on affected machines as stolen and rotate them from a clean computer.
Do: Remove blitzstrike 2.4.180 from all systems and rebuild affected machines from trusted images; Rotate all secrets, keys, and credentials stored on or accessible from affected machines, using a clean computer; Audit affected systems for persistence mechanisms and additional malicious software; Check dependency locks and CI caches for the package and block reinstallation

### [critical] Malware in dsh-moss-wallpaper npm package — full machine compromise, no patched version (no CVE)
https://helix.ml/threat-watch/i/malware-in-dsh-moss-wallpaper-npm-package-full-machine-compromise-no-patched-version-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub published a malware advisory (GHSA-rgvh-3r77-gg9c) for the npm package dsh-moss-wallpaper, flagging version 3.4.0 as containing embedded malicious code (CWE-506). The advisory states that any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists and no source code is known; the package should be treated as attacker-controlled. Anyone who installed dsh-moss-wallpaper 3.4.0 is affected. Because the malware may grant persistent outside access, removal of the package alone cannot be assumed to eliminate the compromise; credential rotation and system rebuild are required.
Do: Remove dsh-moss-wallpaper 3.4.0 from all systems and block it from dependency installs; Rotate all secrets, keys, and credentials stored on affected machines, using a clean computer; Rebuild or reimage affected machines; do not assume package removal removes the malware; Audit systems for persistence and signs of outside access; Check dependency lockfiles and CI environments for the package

### [critical] vibes-plug (npm) — malicious package version 4.5.0 fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/vibes-plug-npm-malicious-package-version-4-5-0-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub's malware advisory database published GHSA-xfv7-hqg2-67x3 on 2026-11-03 flagging version 4.5.0 of the npm package vibes-plug as embedded malicious code (CWE-506). Any machine with the package installed or running should be considered fully compromised, with attackers potentially having full remote control and access to secrets and keys. The package has roughly 178 monthly downloads and 91 GitHub stars, indicating a small but real install base. No patched versions exist and no source code is known; the advisory recommends removal of the package, though removal cannot guarantee elimination of all malicious software planted during installation. Users must rotate all credentials from an uninfected machine.
Do: Rotate all secrets, keys, and credentials stored on machines where vibes-plug 4.5.0 was installed, using a clean computer; Remove vibes-plug 4.5.0 from all projects and lockfiles and audit for persistence mechanisms left behind; Rebuild or thoroughly forensically clean affected machines; do not trust removal alone; Check npm audit logs and CI systems for installs of the package and scan for indicators of compromise

### [critical] service-roles-registry (npm): malicious preinstall script exfiltrates host identifiers via dependency-confusion lure
https://helix.ml/threat-watch/i/service-roles-registry-npm-malicious-preinstall-script-exfiltrates-host-identifiers-via-dependency-confusion-lure · Supply chain · no-fix-needed · since 2026-11-03
A malicious npm package, service-roles-registry@99.0.2, was published to the public registry and flagged by Amazon Inspector via the OpenSSF malicious-packages project. The package runs index.js as a preinstall script that collects os.hostname(), os.userInfo().user, process.cwd(), and package metadata and POSTs them over HTTPS to a hardcoded Pipedream endpoint (eog6t9e6egptozp.m.pipedream.net). The version number and name shape indicate a dependency-confusion lure designed to win resolution against an internal package of the same name, so any developer or CI build that installs it silently leaks host identifiers to a third-party collector. There is no patched version; the fix is to remove and block the package.
Do: Audit lockfiles and CI logs for any install of service-roles-registry@99.0.2; treat affected build hosts' hostname, username, and cwd as disclosed; Remove the package from dependencies and lockfiles; purge npm cache; Block the package name and the pipedream.net endpoint at the registry proxy and egress firewall; Enable dependency-confusion protections: scoped registry mappings, allowlists, and --ignore-scripts for untrusted installs; Rotate credentials accessible from affected build machines if exposure is confirmed

### [critical] Malware in luna-baileys npm package — full host compromise, rotate all secrets
https://helix.ml/threat-watch/i/malware-in-luna-baileys-npm-package-full-host-compromise-rotate-all-secrets · Supply chain · no-fix-needed · since 2026-11-03
GitHub published a malware advisory (GHSA-45rq-6v9r-4475) on 2026-11-03 for the npm package luna-baileys, flagged as containing embedded malicious code (CWE-506). Affected versions include 0.0.0-stage, 1.0.0, and 9.0.24–9.0.28 and 9.0.33, with no patched versions available. GitHub's guidance states any computer with the package installed or running should be considered fully compromised, implying the malware grants outside actors full control of the host, enabling theft of secrets, keys, and credentials. Any project depending on luna-baileys — an apparent WhatsApp/Baileys-style library — is affected. There is no fix; removal of the package does not guarantee removal of all malicious software, so incident response beyond uninstalling is required.
Do: Rotate all secrets, keys, and credentials stored on machines where luna-baileys was installed, using a clean computer; Remove luna-baileys from all projects and lockfiles and audit for transitive dependencies on it; Rebuild/reimage affected machines; do not assume uninstalling removed the malware; Review access logs and monitor for suspicious activity from affected hosts; Block/flag luna-baileys in internal registries and CI to prevent reintroduction

### [critical] Malware in dsh-moss-console: npm package dsh-moss-console v3.3.0 fully compromises installed machines (no CVE)
https://helix.ml/threat-watch/i/malware-in-dsh-moss-console-npm-package-dsh-moss-console-v3-3-0-fully-compromises-installed-machines-no-cve · Supply chain · no-fix-needed · since 2026-11-03
GitHub published advisory GHSA-cw2g-cxwh-wqqm on 2026-11-03 flagging npm package dsh-moss-console version 3.3.0 as malware (CWE-506, embedded malicious code). Any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; all secrets and keys on affected machines must be rotated. No patched version exists and no source code is known, so the only remediation is removal of the package plus full incident response, as removal cannot guarantee elimination of all malicious software. Anyone who installed dsh-moss-console 3.3.0 is affected; exploitation is presumed wherever the package was installed.
Do: Rotate all secrets, keys, and credentials stored on machines where dsh-moss-console 3.3.0 was installed, using a clean computer; Isolate and reimage affected machines; do not rely on simply uninstalling the package; Check install logs and CI/CD systems for the package and audit for follow-on compromise; Block/remove dsh-moss-console from dependency trees and lockfiles

### [critical] paidwithtab npm package 3.0.0 is malware — full machine compromise; no safe version exists
https://helix.ml/threat-watch/i/paidwithtab-npm-package-3-0-0-is-malware-full-machine-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-03
GitHub's malware advisory database flagged the npm package paidwithtab version 3.0.0 as embedded malicious code (CWE-506), published 2026-11-03. The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity. No patched version exists and no source code is known, so the only remediation is removal plus credential rotation. The package had roughly 625 downloads per month, so exposure is limited but real; anyone who installed 3.0.0 should treat all secrets and keys on the affected machine as stolen.
Do: Remove paidwithtab from all machines and CI environments immediately; Rotate all secrets, keys, and credentials stored on affected machines, using a different, clean computer; Rebuild/reimage affected machines; removal of the package does not guarantee removal of malicious software; Audit logs and network traffic for signs of exfiltration or attacker access; Block paidwithtab in dependency allowlists and check lockfiles for the package

### [critical] Dependency-confusion probe: GoParrot dashboard scopes — 25 malicious npm packages by devtest91001 exfiltrate host data
https://helix.ml/threat-watch/i/dependency-confusion-probe-goparrot-dashboard-scopes-25-malicious-npm-packages-by-devtest91001-exfiltrate-host-data · Supply chain · no-fix-needed · since 2026-11-03
On 2026-11-01 the npm account devtest91001 published 25 packages under the newly created @goparrot-dashboard and @goparrot-dashboard-api scopes, adjacent to GoParrot's public @goparrot scope, in a dependency-confusion campaign. Most packages (e.g. @goparrot-dashboard-api/orchestration 0.0.1, @goparrot-dashboard/combo-group 0.0.1, @goparrot-dashboard-api/users 0.0.1, @goparrot-dashboard/category 0.0.1) are probes with no install scripts whose index.js prints a '[rootxravi-poc-security]' marker when loaded. However @goparrot-dashboard/app 0.0.2 runs a preinstall script that sends the hostname, username and working directory to an interactsh callback host (iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun). Any build resolving these scopes from the public registry instead of a private registry would install the malicious packages. GitHub advisories published 2026-11-03 list affected versions with no patched versions; no evidence of compromise of GoParrot itself.
Do: Audit lockfiles and CI logs for any @goparrot-dashboard/* or @goparrot-dashboard-api/* packages and remove them immediately; Check build hosts for outbound connections to iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun and rotate credentials on any machine that installed these packages; Ensure private packages in these scopes are pinned to an internal registry and configure npm scope-registry mapping to prevent public resolution; Block the callback domain at egress and monitor for similar lookalike-scope publications; Report the packages and account to npm for takedown

### [critical] Dependency-confusion probe packages: @goparrot-dashboard scope on npm — squatting scope published 25 packages, one exfiltrates host data (no CVE)
https://helix.ml/threat-watch/i/dependency-confusion-probe-packages-goparrot-dashboard-scope-on-npm-squatting-scope-published-25-packages-one-exfiltrate · Supply chain · no-fix-needed · since 2026-11-03
On 2026-11-01 the npm account devtest91001 published 25 packages under the newly created @goparrot-dashboard and @goparrot-dashboard-api scopes, adjacent to GoParrot's public @goparrot scope, in a dependency-confusion campaign. Four packages (franchise-menu-settings, settings, marketing, order, all 0.0.1) are inert probes that print a '[rootxravi-poc-security]' marker on load with no install scripts, but @goparrot-dashboard/app 0.0.2 runs a preinstall script that sends the hostname, username and working directory to an interactsh callback host (iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun). Any build resolving these scoped names from public npm instead of a private registry would install the malicious packages. GitHub advisories (GHSA-89qx-w49w-4q48, GHSA-q8c5-hxhq-jprv, GHSA-332r-cpwr-xr6h, GHSA-fc2g-x424-gvq4) were published 2026-11-03 with no patched versions; affected packages should be removed from npm and blocked.
Do: Audit lockfiles and build logs for any @goparrot-dashboard or @goparrot-dashboard-api packages and remove them immediately; Check CI/build hosts for outbound connections to iuczektmwpudhwqnsbkgc6m8nx2dgn5vc.oast.fun and treat any hit as host-data exposure; Configure npm/.npmrc to never resolve internal scopes from the public registry (scope-scoped registry mapping, --no-audit installs from private feed only); Block the callback domain at DNS/proxy egress and add it to threat-intel blocklists; Reserve/claim internal package names publicly or use scoped registry allowlists to prevent future dependency confusion

### [critical] Malicious npm package @corexium/xbails aliases libsignal to attacker-controlled fork
https://helix.ml/threat-watch/i/malicious-npm-package-corexium-xbails-aliases-libsignal-to-attacker-controlled-fork · Supply chain · no-fix-needed · since 2026-11-03
GitHub Advisory Database (via OpenSSF/amazon-inspector) flagged npm package @corexium/xbails@0.0.7 as malicious. Its package.json aliases the import name 'libsignal' to the third-party package '@bellaxchuu/libsignal-node' pinned only to the mutable '@latest' dist-tag, with no version pin, integrity check, or provenance tie to upstream libsignal-node. The package imports libsignal at module load time for E2E-encryption primitives (SessionCipher, SessionRecord, ProtocolAddress, SessionBuilder in lib/Signal/libsignal.js and curve.js), so the fork's maintainer controls arbitrary code executed at require/import time, including in the cryptographic session-handling path. Any project installing @corexium/xbails 0.0.7 is exposed. No patched version exists; the package is malware and should be removed.
Do: Remove @corexium/xbails from all dependencies and lockfiles immediately; Audit installs of version 0.0.7 for compromise; rotate secrets and keys on affected machines; Check whether @bellaxchuu/libsignal-node is present in node_modules or lockfiles and remove it; Pin all npm aliases to exact versions with integrity hashes; avoid @latest dist-tags; Block these packages in registry proxies and CI dependency scanning

### [critical] Malicious npm package @atedone/workspace-context hijacks zsh via precmd hook and C2 prompt injection
https://helix.ml/threat-watch/i/malicious-npm-package-atedone-workspace-context-hijacks-zsh-via-precmd-hook-and-c2-prompt-injection · Supply chain · no-fix-needed · since 2026-11-03
GitHub advisory GHSA-39ch-q3p3-3j33 (published 2026-11-03, credited to OpenSSF/amazon-inspector) flags every published version (0.0.12–0.0.25) of the npm package @atedone/workspace-context as malware with no patched versions. On require(), the package writes shell integration files to ~/.config/workspace-context, spawns a detached Node worker launching /bin/zsh -i with ZDOTDIR pointed there, and installs a zsh precmd hook that re-executes a script on every prompt — a persistent foothold from merely importing the module. It fetches attacker-controlled JSON over plaintext HTTP from hardcoded IP 150.136.8.159:8080 (appending the local username) and injects it into the live zsh PROMPT. APIs are obfuscated via string-fragment joins and Reflect.get/Reflect.apply, and process.binding('spawn_sync') bypasses child_process. Anyone who installed the package is affected; there is no fix — remove it and clean the shell persistence.
Do: Remove @atedone/workspace-context from all projects and lockfiles immediately; treat any machine where it was installed as compromised; Delete ~/.config/workspace-context and inspect ~/.zshrc, ZDOTDIR settings, and zsh precmd hooks for persistence; Rotate credentials and secrets accessible from affected user accounts and review outbound connections to 150.136.8.159:8080; Audit environments for the WORKSPACE_CONTEXT_CHANNEL env var and any spawned node/zsh processes; Block the C2 IP 150.136.8.159 at network egress and hunt for the username-exfiltration HTTP pattern

### [critical] ms-client-portal npm dependency-confusion malware: install scripts beacon environment data to 38.242.235.206 (no CVE)
https://helix.ml/threat-watch/i/dependency-confusion-beacon-ms-client-portal-npm-package-phones-home-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-02
A dependency-confusion attack published malicious npm packages ms-client-portal (versions 1.0.0 and 10.0.0), internal-renderers and pandafortunerush on 2026-10-31 via account amahrou1a. The packages contain no functional code; their preinstall/postinstall scripts run node -e one-liners sending HTTP GET beacons to http://38.242.235.206/depconf/... with username, hostname and working directory in the query string. GitHub advisory GHSA-q7rp-q644-j8rp (CWE-506) escalates the assessment: any computer with the package installed or running should be considered fully compromised, with possible full control handed to an outside entity, and all secrets and keys on it rotated. The README claims ms-client-portal is an internal project name leaked in a health-sector client portal's production bundle. No patched versions exist; packages remain on npm. Organisations whose internal package names leaked into public web bundles and whose developers run npm install are at risk.
Do: Treat any machine where ms-client-portal, internal-renderers or pandafortunerush was installed as fully compromised: rotate all secrets and keys stored on it immediately, from a different machine; Search npm lockfiles and CI logs for the three package names and for connections to 38.242.235.206; review build/CI telemetry for further compromise; Block 38.242.235.206 at egress and disable npm install lifecycle scripts (npm config set ignore-scripts true) in CI and on developer machines; Audit internal package names for public exposure in web bundles and register them as placeholders in npm scopes to prevent future dependency confusion

### [critical] scdn-jquery npm package is malware — full machine compromise, no safe version
https://helix.ml/threat-watch/i/scdn-jquery-npm-package-is-malware-full-machine-compromise-no-safe-version · Supply chain · no-fix-needed · since 2026-11-03
GitHub published advisory GHSA-hvpp-rx4h-crg5 on 2026-11-03 flagging the npm package scdn-jquery as malware (CWE-506, embedded malicious code). Every published version (>= 0) is affected and no patched version exists, so any installation grants attackers full control of the machine. The advisory states computers running the package should be considered fully compromised and recommends rotating all secrets and keys from a separate, clean machine, since removing the package cannot guarantee removal of all malicious software it deployed. Any developer or CI environment that installed scdn-jquery is affected; there is no safe version to upgrade to — the package must be removed and the environment rebuilt.
Do: Treat any machine that installed or ran scdn-jquery as fully compromised; rotate all secrets, keys, and credentials from a clean computer; Remove the package and rebuild/reimage affected machines and CI runners rather than trusting cleanup; Audit dependency lockfiles and install history for scdn-jquery across all projects and pipelines; Review access logs and tokens (npm, GitHub, cloud) for signs of misuse since installation; Block scdn-jquery in package registries/proxies and alert teams not to install it

### [critical] pyprig PyPI malware: trojanized Pydantic clone downloads and executes remote code on model initialization
https://helix.ml/threat-watch/i/pyprig-pypi-malware-trojanized-pydantic-clone-downloads-and-executes-remote-code-on-model-initialization · Supply chain · no-fix-needed · since 2026-11-03
GitHub Advisory Database (GHSA-25jm-3g7h-jgf6) and OpenSSF malicious-packages report a malicious PyPI package, pyprig, published as a clone of the legitimate Pydantic package. A runner was injected into the cloned Pydantic code that downloads a remote script from a GitHub repository, unpacks it as a new module, and executes it during initialization of any models. At analysis time the remote payload was only a placeholder, but the campaign is classified MALICIOUS with intent such as infostealing. Affected versions are 1.2.0, 1.2.1 and 1.2.2; there are no patched versions and the package should be treated as malware. Any project that installed pyprig is affected; the advisory was published 2026-11-03.
Do: Remove pyprig from all environments and dependency lockfiles immediately; do not upgrade within the package; Audit systems where pyprig was installed for signs of executed remote code, credential theft or persistence; Rotate credentials, tokens and secrets accessible from affected machines; Check CI/CD pipelines and build caches for pyprig and rebuild from clean environments; Pin and verify the legitimate Pydantic package by hash going forward

### [medium] Furl (Perl HTTP client): memory exhaustion via unbounded gzip/deflate response decompression (CVE-2026-65059)
https://helix.ml/threat-watch/i/furl-perl-http-client-memory-exhaustion-via-unbounded-gzip-deflate-response-decompression-cve-2026-65059 · Supply chain · unpatched · since 2026-11-02 · CVE-2026-65059
The CPAN Security Group disclosed CVE-2026-65059 on 2026-11-02: Furl, a Perl HTTP client, versions through 3.15 inflate response bodies with gzip, x-gzip or deflate Content-Encoding and append the output to the in-memory response string with no size limit, regardless of whether compression was requested, and offer no option to cap decompressed size. A malicious server, or an attacker on a plain HTTP connection, can send a small compressed response that expands to exhaust client memory and kill the process (CWE-409, data amplification). Responses streamed via write_file or write_code are not held in memory and are unaffected. No fixed CPAN release is available yet; a fix is discussed in GitHub PR #139. Any application using Furl to fetch content from untrusted or attacker-influenced servers is affected.
Do: Inventory Perl services and scripts using Furl and identify those fetching from untrusted or attacker-controllable servers; Where possible, switch affected fetches to write_file/write_code streaming so bodies are not held in memory; Apply size limits upstream (e.g., proxy or validate Content-Length / decompressed size) or use an alternative HTTP client until a fixed Furl release ships; Monitor the Furl MetaCPAN page and GitHub PR #139 for the fixed release and patch promptly when available

### [critical] pandafortunerush (npm): malicious package fully compromises machines that install it; no safe version exists (no CVE)
https://helix.ml/threat-watch/i/pandafortunerush-npm-malicious-package-fully-compromises-machines-that-install-it-no-safe-version-exists-no-cve · Supply chain · no-fix-needed · since 2026-11-02
GitHub published a malware advisory (GHSA-m4h2-gmhc-mhcp) on 2026-11-02 for the npm package pandafortunerush, classifying it as embedded malicious code (CWE-506). Every published version (>= 0) is affected and no patched version exists, so any install grants attackers full control of the host. Any machine with the package installed or running should be treated as fully compromised, with secrets and keys exposed to an outside entity. Removal of the package does not guarantee removal of all malicious software it deployed. Roughly 561 monthly downloads indicate some real-world exposure. There is no fix; remediation is host-level incident response, not a version bump.
Do: Treat any machine with pandafortunerush installed or running as fully compromised; isolate it immediately; Rotate all secrets, keys, tokens and credentials stored on or accessible from affected machines, from a clean computer; Remove the package and rebuild/reimage affected hosts; do not assume removal clears the malware; Audit dependency lockfiles, CI caches and developer machines for the package and block it in registries/proxies; Review logs and network traffic for signs of attacker access following compromise

### [critical] internal-renderers (npm): malicious package compromises machines and steals secrets (no CVE)
https://helix.ml/threat-watch/i/internal-renderers-npm-malicious-package-compromises-machines-and-steals-secrets-no-cve · Supply chain · no-fix-needed · since 2026-11-02
GitHub's advisory database published a malware advisory for the npm package internal-renderers (GHSA-whfc-859g-h5j3) on 2026-11-02. The package, which sees roughly 524 downloads per month, contains embedded malicious code (CWE-506) in every published version (>= 0), with no patched versions available. GitHub warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity; removal of the package does not guarantee removal of all malicious software. All developers and CI systems that installed internal-renderers are affected. There is no fix; remediation requires removal, secret rotation from a clean machine, and system rebuild.
Do: Rotate all secrets and keys stored on any machine where the package was installed, using a different, uncompromised computer; Remove internal-renderers from all projects, lockfiles, and CI pipelines; audit dependencies for it; Rebuild or reimage affected machines and CI runners; assume full compromise; Review access logs and cloud/registry activity for signs of attacker use; Block future installs of the package via registry allowlists or policy

### [critical] Malicious npm package bfvkjmeikpwhqxc — full system compromise on install (no CVE)
https://helix.ml/threat-watch/i/malicious-npm-package-bfvkjmeikpwhqxc-full-system-compromise-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-02
GitHub published a malware advisory (GHSA-pg3x-mr83-5crv) on 2026-11-02 for the npm package bfvkjmeikpwhqxc, flagging versions 0.0.0-stage, 1.0.0 and 1.0.1 as containing embedded malicious code (CWE-506). The advisory states any computer with the package installed or running should be considered fully compromised, with full control potentially handed to an outside entity; removing the package does not guarantee removal of the malicious software. No patched versions exist and no source code is known. Any developer or CI environment that installed the package is affected; secrets and keys on those machines must be treated as stolen.
Do: Rotate all secrets, keys, tokens and credentials stored on any machine where the package was installed, using a clean machine; Remove the package from all projects, lockfiles and CI caches; Rebuild or wipe affected machines and CI runners; audit for persistence; Review access and network logs for signs of exfiltration or attacker activity

### [critical] Malicious npm package 'unjailed' — full system compromise; no safe version exists
https://helix.ml/threat-watch/i/malicious-npm-package-unjailed-full-system-compromise-no-safe-version-exists · Supply chain · no-fix-needed · since 2026-11-02
GitHub's malware advisory database (GHSA-89v8-j949-j3h5) flags the npm package 'unjailed' as containing embedded malicious code (CWE-506). All versions (>= 0) are affected and no patched version exists. Any machine with the package installed or running must be considered fully compromised, with control potentially handed to an outside entity — enabling secret and key theft and persistence beyond simple package removal. The package sees roughly 8,000 downloads per month, so developer machines and CI environments that pulled it are at risk. Removal of the package alone is not guaranteed to remove all malicious software it installed. There is no fix; remediation is incident response, not upgrading.
Do: Rotate all secrets, keys, and credentials stored on any machine where unjailed was installed, using a clean machine; Rebuild affected machines and CI runners from trusted images rather than just uninstalling the package; Audit systems and logs for signs of compromise and persistence mechanisms; Check dependency trees and lockfiles for unjailed and block it in package registries/proxies

### [critical] Malicious npm packages: tailwind-animate-test, tailwind-animate-final, tailwind-animatrix, tailwind-animate-engine — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-packages-tailwind-animate-test-tailwind-animate-final-tailwind-animatrix-tailwind-animate-engine-full-syst · Supply chain · no-fix-needed · since 2026-11-02
GitHub published four malware advisories on 2026-11-02 for npm packages tailwind-animate-test (GHSA-vpvh-94mq-8h4j), tailwind-animate-final (GHSA-4hf4-p92p-5m6c), tailwind-animatrix (GHSA-rfxc-3373-jvfq) and tailwind-animate-engine (GHSA-rqhx-p7qj-qqc8). All versions (>= 0) are affected and no patched versions exist; the packages contain embedded malicious code (CWE-506) and appear to be typosquat-style malicious packages targeting Tailwind animation tooling. GitHub states any computer with these packages installed or running should be considered fully compromised, implying credential and secret theft with attacker control. Removal of the package does not guarantee removal of the malicious software. No fix is available; remediation is removal plus full incident response.
Do: Check lockfiles and node_modules for tailwind-animate-test, tailwind-animate-final, tailwind-animatrix or tailwind-animate-engine and remove them from all projects and CI caches; Treat any machine or CI runner where they were installed as fully compromised: rotate all secrets, keys, tokens and credentials from a clean machine; Rebuild affected environments from trusted images and audit for persistence mechanisms; Block the package names in npm registries, proxy repositories and dependency firewall policies; Review npm install logs to determine exposure window and scope

### [critical] cutekitten05 npm typosquat campaign: axelarjs-sdk, wallet-adapter-base, contracts-upgradeable, sol-wallet-adapter exfiltrate host info via Discord webhook
https://helix.ml/threat-watch/i/cutekitten05-npm-typosquat-campaign-axelarjs-sdk-wallet-adapter-base-cutekitten-test-bigbob22-test-exfiltrate-host-info · Supply chain · no-fix-needed · since 2026-11-02
On 2026-11-01 the npm account cutekitten05 published malicious packages — axelarjs-sdk@1.0.1 (typosquatting @axelar-network/axelarjs-sdk), wallet-adapter-base@1.0.0 (typosquatting @solana/wallet-adapter-base), contracts-upgradeable, cutekitten-test@1.0.1, bigbob22-test@1.0.0 and sol-wallet-adapter — containing no functional code. Each runs a preinstall script (node preinstall.js) that POSTs the machine's hostname, OS username and local time to a Discord webhook as 'PC Notifier'. GitHub advisories GHSA-69w5-x7cm-v78h, GHSA-r89f-jjgp-3q97, GHSA-pw4j-9v86-8c3g, GHSA-j2hf-rv9p-8jvr, GHSA-8cf8-9j3v-99g4, GHSA-r55f-fj5f-qxf9, GHSA-43pw-v6x2-9gh4 and GHSA-9h7q-53gw-grwc were published 2026-11-02 with critical severity, CWE-506, and no patched versions; GitHub warns any machine that installed them should be considered fully compromised. Anyone installing these packages executes the exfiltration script; remove them and treat affected machines as compromised.
Do: Search lockfiles and npm install history for axelarjs-sdk, wallet-adapter-base, contracts-upgradeable, cutekitten-test, bigbob22-test and sol-wallet-adapter and remove any instances; If installed, treat the machine as fully compromised: rotate all secrets and keys from a different machine, identify the hostname/username exposed and review for further compromise; Pin to scoped packages (@axelar-network/axelarjs-sdk, @solana/wallet-adapter-base) and verify package provenance before installing similarly named packages; Block the Discord webhook domain/URL in egress filtering and monitor for callbacks; Enable npm audit/GitHub Dependabot alerts and consider install-script disabling (npm config set ignore-scripts true)

### [critical] bigdevin55 npm malware campaign: calculator-preinstall-hook-demo and related packages exfiltrate hostname and username via Discord webhook
https://helix.ml/threat-watch/i/malicious-npm-package-calculator-preinstall-hook-demo-exfiltrates-hostname-and-username-via-discord-webhook · Supply chain · no-fix-needed · since 2026-11-02
GitHub Advisory Database advisories (GHSA-p373-68vj-fvrh, GHSA-c6pj-8fr8-qq3c, GHSA-gmrr-hqfh-q4j3, GHSA-v4v4-v74v-86vq, GHSA-fr4c-gqv9-5rgx, credited to OpenSSF) flag a campaign of malicious npm packages published by the account bigdevin55: calculator-preinstall-hook-demo@1.1.2, calculator-preinstall-chain-demo@1.1.2 (which pulls in the hook package as a dependency), @bigdevin55/calculator-install-hook (~230 downloads/month), and @bigdevin55/calculator-install-demo (~197 downloads/month). The packages pose as npm lifecycle-hook test fixtures, but their preinstall scripts run node preinstall.js during npm install, POSTing the machine's hostname and OS username to a hardcoded Discord webhook. Advisories state any computer with the packages installed should be considered fully compromised and all secrets rotated. Affected versions are all versions (>= 0); there are no patched versions, and the packages should be treated as malware and removed. Anyone who installed any of these packages may have leaked host and user details.
Do: Check lockfiles and installed node_modules for calculator-preinstall-hook-demo, calculator-preinstall-chain-demo, @bigdevin55/calculator-install-hook and @bigdevin55/calculator-install-demo; remove them and purge caches; If installed, treat the machine as fully compromised: rotate all secrets and keys available to the user account from a different computer, review access logs, and consider rebuilding from a clean image; Block the Discord webhook URL and monitor egress for connections to discord.com/api/webhooks from CI and developer machines; Audit npm install logs to determine whether the preinstall script executed and when; Pin dependencies and avoid installing unvetted packages, especially those with lifecycle scripts

### [critical] Malicious npm package @utilitycraft/tailwindcss-motion-atelier compromises installers' machines
https://helix.ml/threat-watch/i/malicious-npm-package-utilitycraft-tailwindcss-motion-atelier-compromises-installers-machines · Supply chain · no-fix-needed · since 2026-11-02
GitHub's advisory database published a malware advisory (GHSA-cv4q-j2g9-xp9h, CWE-506 Embedded Malicious Code) for the npm package @utilitycraft/tailwindcss-motion-atelier. Every published version (>= 0) is malicious and there are no patched versions, so the package should be treated as fully compromised on any machine where it was installed or run. The advisory warns that installing it may have given an outside entity full control of the computer, meaning secrets and keys stored on affected machines must be rotated and removal of the package alone cannot be assumed to remove all malicious software. No common malware name, CVE, or specific victim organisations are given; the incident became public on 2026-11-02.
Do: Remove @utilitycraft/tailwindcss-motion-atelier from all projects and lockfiles immediately; Treat every machine where it was installed or run as fully compromised; rebuild from clean images where possible; Rotate all secrets, keys, tokens and credentials stored on affected machines, from a different, clean computer; Audit logs and network activity on affected hosts for signs of attacker access or persistence; Block the package in internal registries and CI to prevent reinstalls

### [critical] Malicious npm package tailwindcss-animate-bridge compromises developer machines
https://helix.ml/threat-watch/i/malicious-npm-package-tailwindcss-animate-bridge-compromises-developer-machines · Supply chain · no-fix-needed · since 2026-11-02
GitHub published advisory GHSA-4q2f-q5qq-w9cm on 2026-11-02 flagging the npm package tailwindcss-animate-bridge as malware (CWE-506, embedded malicious code). Every published version (>= 0) is affected and no patched version exists, so any installation is inherently malicious. The advisory states that any computer with the package installed or running should be considered fully compromised, implying attackers gain full control and can steal secrets, keys, and credentials. No source code repository is known. Any developer or CI environment that installed the package is affected; removal of the package alone cannot be assumed to remove all malicious software. There is no fix — the only remediation is removal plus full incident response.
Do: Rotate all secrets, keys, and credentials stored on or accessible from any machine where the package was installed, using a clean machine; Remove the package from all projects, lockfiles, and CI caches and block its installation; Rebuild affected machines and audit for persistence mechanisms and other malicious software; Review logs and network traffic for signs of exfiltration or attacker access; Audit dependency trees for other typosquatting or malicious packages

### [critical] Malicious npm packages atlassian-wallboard-plugin and atlassian-wallboard-plugin1 fully compromise hosts
https://helix.ml/threat-watch/i/malicious-npm-packages-atlassian-wallboard-plugin-and-atlassian-wallboard-plugin1-fully-compromise-hosts · Supply chain · no-fix-needed · since 2026-11-02
GitHub published malware advisories on 2026-11-02 for two npm packages, atlassian-wallboard-plugin (GHSA-m4gq-5vx2-5x8c) and atlassian-wallboard-plugin1 (GHSA-frgx-cf5w-vxr5), both classified CWE-506 Embedded Malicious Code with critical severity. Every version (>= 0) is affected and no patched versions exist. The advisory warns that any computer with the package installed or running should be considered fully compromised, with control potentially handed to an outside entity, and that removal of the package does not guarantee removal of all malicious software. Anyone who installed either package is affected; no in-the-wild exploitation details are given. There is no fix — the packages must be removed and credentials rotated.
Do: Remove atlassian-wallboard-plugin and atlassian-wallboard-plugin1 from all systems and dependency trees immediately; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild/reimage compromised hosts; do not assume package removal removed the malware; Audit CI/CD and lockfiles for historical installs of these packages; Block both package names in npm registries and internal proxies

### [critical] GamerD11/ping_test npm malware: claims-ac1 exfiltrates host details via install script (no CVE)
https://helix.ml/threat-watch/i/gamerd11-ping-test-npm-malware-claims-ac1-exfiltrates-host-details-via-install-script-no-cve · Supply chain · no-fix-needed · since 2026-11-02
OpenSSF reported npm package claims-ac1 1.0.0 as malicious. The package contains only a package.json pulling node-ac2 from a GitHub tarball (GamerD11/ping_test), which chains to node-ac3 whose preinstall script runs node index.js. The script fetches a collector host from a test.txt file in the same GitHub repo (an oastify.com host when observed) and, if non-empty, POSTs the Node.js version, home directory, working directory, platform and architecture to that host over HTTPS with certificate verification disabled. The package has no legitimate functionality, and because the payload and collector host live outside npm, they can be changed without a new release. The same repo/mechanism is used by claims-acct-unlock (MAL-2026-18404) and dependencykfeg (MAL-2026-18416). No patched version exists; affected machines should remove the package.
Do: Remove claims-ac1 (and claims-acct-unlock / dependencykfeg if present) from all machines and lockfiles; Assume host details (Node version, home and working directories, platform, architecture) were disclosed; assess exposure and rotate any secrets in those paths if warranted; Audit npm install logs and CI for installs of these packages and for connections to oastify.com or hosts listed in GamerD11/ping_test/test.txt; Block installs of these packages and tarball dependencies from github.com/GamerD11/ping_test in dependency firewalls/CI

### [critical] persona-ai-sdk (npm): malicious package v1.0.0 fully compromises machines that install it (no CVE)
https://helix.ml/threat-watch/i/persona-ai-sdk-npm-malicious-package-v1-0-0-fully-compromises-machines-that-install-it-no-cve · Supply chain · no-fix-needed · since 2026-11-02
GitHub's advisory database published a malware advisory for the npm package persona-ai-sdk, version 1.0.0, on 2026-11-02. The package contains embedded malicious code (CWE-506) and any computer where it is installed or running should be considered fully compromised, with control potentially handed to an outside entity. There are no patched versions and no known legitimate source code; the package should be treated as malware rather than a flawed dependency. Anyone who installed persona-ai-sdk 1.0.0 is affected. Remediation requires removing the package, rotating all secrets and keys from a clean machine, and forensic checks, since removal alone may not eliminate the malicious software.
Do: Remove persona-ai-sdk 1.0.0 from all projects and block it in dependency policies; Rotate all secrets, API keys, tokens and credentials stored on affected machines, using a clean computer; Rebuild/reimage affected machines and run forensics to check for persistence, as removal may not eliminate the malware; Audit CI/CD and developer machines for the package and review any credentials accessible from them

### [critical] zystcdemo (npm): malicious postinstall payload exfiltrates host info to srctest.zystcc.cn on install
https://helix.ml/threat-watch/i/zystcdemo-npm-malicious-postinstall-payload-exfiltrates-host-info-to-srctest-zystcc-cn-on-install · Supply chain · no-fix-needed · since 2026-11-02
The npm package zystcdemo, published by account 'zyst' on 2026-10-29, poses as a simple date formatting utility but contains malicious code flagged by OpenSSF and added to the GitHub Advisory Database (GHSA-xpgj-8rc5-pq44, CWE-506) on 2026-11-02. Version 1.0.0 runs a postinstall script (node postinstall.js) during npm install, collecting the whoami result, hostname, platform, and current time, and POSTing them to https://srctest.zystcc.cn/collect. Any developer or CI system that installs the package executes the payload automatically. There are no patched versions; the package is malware and should be removed entirely. Affected users should audit for the package and any data sent to the collection endpoint.
Do: Search dependency trees, lockfiles, and CI caches for zystcdemo@1.0.0 and remove it; do not install; Check install logs and network/proxy logs for connections to srctest.zystcc.cn/collect; Treat any machine or CI runner that installed it as compromised; review exposed user/host information; Rotate credentials if whoami/hostname data could enable targeted follow-up attacks; Block the domain srctest.zystcc.cn at egress

### [critical] Solana wallet stealer npm campaign: @johnruff215-dev/solana-wallet-tracker & @notrainer/nobtrainer-sdk exfiltrate wallet data via Discord webhook
https://helix.ml/threat-watch/i/solana-wallet-stealer-npm-campaign-johnruff215-dev-solana-wallet-tracker-notrainer-nobtrainer-sdk-exfiltrate-wallet-data · Supply chain · no-fix-needed · since 2026-11-02
Two npm packages, @johnruff215-dev/solana-wallet-tracker and @notrainer/nobtrainer-sdk, were identified as malicious information stealers published to the GitHub Advisory Database on 2026-11-02 (GHSA-w48h-24q2-rjqx and GHSA-8cq9-2c2q-58ww). The solana-wallet-tracker package steals Solana cryptocurrency wallet data; nobtrainer-sdk exfiltrates sensitive data from the victim host. Both send stolen data to the same attacker-controlled Discord webhook (ID 1433690093175967776), linking them to a single campaign. All published versions are malicious (solana-wallet-tracker >0, 1.0.0, 1.0.1; nobtrainer-sdk >0, 1.0.2–1.0.5); there are no patched versions and the packages provide no legitimate functionality. solana-wallet-tracker had ~531 downloads/month. Any developer or CI environment that installed either package should treat wallet keys and host credentials as compromised.
Do: Remove both packages from all projects, lockfiles and CI caches immediately; Rotate any Solana wallet keys, seed phrases and signing keys present on affected machines; Rebuild affected machines/CI runners from clean images and revoke stored credentials, tokens and SSH keys; Audit dependency manifests and lockfiles for the two package names and block them in registry proxies/firewalls; Review exfiltration paths to discord.com webhooks in egress logs for evidence of data loss

### [medium] Dependency-confusion PoC package: @mobile-platform/magnetic-components (npm) — preinstall script runs on install, phones home via DNS
https://helix.ml/threat-watch/i/dependency-confusion-poc-package-mobile-platform-magnetic-components-npm-preinstall-script-runs-on-install-phones-home-v · Supply chain · no-fix-needed · since 2026-11-02
A dependency-confusion package, @mobile-platform/magnetic-components, was published to npm by account io-8 on 2026-10-29 in versions 0.0.1–0.0.3. The scoped name reportedly appears in the Meraki Dashboard Android app's bundled JavaScript but was unclaimed on the public registry, so any build resolving the scope from npm executes the attacker's preinstall script (node preinstall.js) with the installing user's privileges. Versions 0.0.1–0.0.2 drop a DEPENDENCY_CONFUSION_POC_MARKER.txt file; 0.0.3 performs a DNS lookup of a fixed subdomain of an interactsh callback host (oast.me) to signal installation. No host data beyond the DNS lookup is sent, and no patched versions exist — the package is malware and should be removed, not upgraded. Flagged by OpenSSF and published to the GitHub Advisory Database (GHSA-q54x-hhg5-963x) on 2026-11-02.
Do: Audit npm install logs and CI systems for any install of @mobile-platform/magnetic-components since 2026-10-29; treat affected build hosts as compromised pending review; Check for DEPENDENCY_CONFUSION_POC_MARKER.txt files and DNS/interactsh callbacks to *.oast.me subdomains; Remove/block the package and pin the @mobile-platform scope to the private registry; Configure .npmrc with a private registry mapping for the @mobile-platform scope and enable registry allow-lists to prevent future dependency confusion; Rotate any credentials accessible from affected CI/build environments if compromise is confirmed

### [critical] litecore-lib-ltc typosquat npm wallet stealer — harvests Litecoin keys, exfiltrates via Discord webhook
https://helix.ml/threat-watch/i/litecore-lib-ltc-typosquat-npm-wallet-stealer-harvests-litecoin-keys-exfiltrates-via-discord-webhook · Supply chain · no-fix-needed · since 2026-11-02
OpenSSF and the GitHub Advisory Database (GHSA-9jxw-2pvm-5q9f, published 2026-11-02) report that the npm package litecore-lib-ltc is a typosquat of the legitimate litecore-lib Litecoin library. Every published version (1.0.0 and 1.9.3–1.9.14, plus >0) is malicious: the package harvests Litecoin wallet keys and addresses, queries the public BlockCypher API (api.blockcypher.com) to identify which harvested addresses hold funds, and exfiltrates the stolen wallet material to an attacker-controlled Discord webhook. It is classified as a cryptocurrency-wallet information stealer and provides no legitimate functionality. There are no patched versions; the package should be treated as fully malicious. Full indicators, including the complete webhook URL, are published in the OpenSSF malicious-packages entry (MAL-2026-18442).
Do: Remove litecore-lib-ltc from all dependencies and lockfiles immediately; Rotate any Litecoin private keys or seed phrases that may have been present on affected machines; Audit systems and CI for the package and the published exfiltration indicators (Discord webhook, api.blockcypher.com lookups); Check wallet transaction history for unexpected movements from exposed addresses; Replace with the legitimate litecore-lib package if functionality is needed

### [critical] self-v8 (npm): malicious info-stealer package exfiltrates host data to attacker Discord webhook
https://helix.ml/threat-watch/i/self-v8-npm-malicious-info-stealer-package-exfiltrates-host-data-to-attacker-discord-webhook · Supply chain · no-fix-needed · since 2026-11-02
OpenSSF and the GitHub Advisory Database (GHSA-354j-r6m9-986p) report that the npm package self-v8 is malware: an information stealer that harvests sensitive data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. The package provides no legitimate functionality, so every published version (including 1.0.0, 2.1.8, 2.1.9, 8.1.9, 8.3.9, 8.5.9, 8.7.9, 8.9.9 and >0) is malicious, and no patched version exists. It receives roughly 2,024 downloads per month, so any project or developer that installed it is presumed compromised. Remediation is removal of the package plus incident response on affected hosts; there is no fix version to upgrade to.
Do: Remove self-v8 from all projects and lockfiles immediately; do not reinstall any version; Treat hosts and CI environments where it was installed as compromised: rotate secrets, tokens, credentials, and keys accessible there; Audit for data exfiltration and review network/Discord webhook traffic indicators from the OpenSSF advisory; Check dependency trees and CI caches for residual copies and block the package name in registry policy; Monitor for follow-on account compromise or fraud using any harvested credentials

### [critical] wallet-tracking PyPI package: cryptocurrency-wallet information stealer exfiltrating data via Discord webhook
https://helix.ml/threat-watch/i/wallet-tracking-pypi-package-cryptocurrency-wallet-information-stealer-exfiltrating-data-via-discord-webhook · Supply chain · no-fix-needed · since 2026-11-02
The PyPI package wallet-tracking is a cryptocurrency-wallet information stealer with no legitimate functionality; all published versions (1.0.0–1.0.6 and >0) are malicious. It collects wallet data on the victim host and exfiltrates it to an attacker-controlled Discord webhook. The source contains an unconfigured placeholder webhook URL (…/api/webhooks/YOUR_URL) alongside the live one, indicating a copy-paste stealer template. First observed by wormsign on 2026-05-30 and published to the GitHub Advisory Database on 2026-11-02 (GHSA-8wmf-9cp5-g5hq, CWE-506). Anyone who installed the package is affected; there are no fixed versions, so remediation is removal and credential/wallet rotation.
Do: Remove wallet-tracking from all environments and purge cached copies; Rotate cryptocurrency wallet keys, seed phrases, and any secrets accessible from affected hosts; Audit affected hosts for exfiltration activity to Discord webhooks and other attacker infrastructure; Check dependency lockfiles and CI pipelines for the package and block it in dependency firewalls

### [critical] pipeprobe-obf-m19n5: malicious npm package phones home via obfuscated DNS callback on install (no CVE)
https://helix.ml/threat-watch/i/pipeprobe-obf-m19n5-malicious-npm-package-phones-home-via-obfuscated-dns-callback-on-install-no-cve · Supply chain · no-fix-needed · since 2026-11-02
GitHub Advisory Database (GHSA-xq83-5ggr-7222, credited to OpenSSF/amazon-inspector) flags the npm package @an1mshnpmb9c84920/pipeprobe-obf-m19n5 version 1.0.0 as malicious. Its prepare lifecycle script runs node index.js, which assembles the hostname npmp19n5--768.oob.awss.dev from a string array at runtime to evade static scanners and performs a DNS lookup via require('dns').lookup(). The host is an out-of-band callback domain with a unique per-package label, so installing the package signals code execution on the installer's machine to the domain operator. The package offers no legitimate functionality. Anyone who installed version 1.0.0 is affected; there is no patched version, so remediation is removal and investigation.
Do: Remove @an1mshnpmb9c84920/pipeprobe-obf-m19n5 from all projects and lockfiles; Audit install logs and DNS/network logs for connections to *.oob.awss.dev, especially npmp19n5--768.oob.awss.dev; Treat any machine where the package was installed as potentially compromised and investigate for follow-on activity; Block the oob.awss.dev domain at DNS/proxy level; Scan dependencies for packages with lifecycle scripts performing obfuscated DNS or HTTP callbacks

### [critical] pystr-codec (PyPI): .pth file runs a credential-stealing worm on every Python start (no CVE)
https://helix.ml/threat-watch/i/miasma-worm-pystr-codec-malicious-pypi-package-executes-pth-based-credential-theft-and-worm-payload-on-python-startup-no · Supply chain · no-fix-needed · since 2026-11-01
pystr-codec versions 0.1.0, 0.1.1 and 0.1.2 on PyPI are malicious, and no clean release exists. A .pth file in the package runs obfuscated JavaScript on the Bun runtime at every Python interpreter start, so a project does not need to import the package for the payload to run. The payload takes credentials, posts them to a public GitHub repository, keeps a persistent foothold that waits for remote commands, uses the credentials it finds to spread, re-checks them periodically, and performs destructive actions on the host once they stop working. Kam193 (Bad Packages) files it under the 2026-11-pystr-codec campaign, which lists this one package, and calls it part of the Miasma-family worm also known as testmetest; SafeDep's testmetest analysis covers npm only and says that family's lineage to Miasma is not confirmed. GHSA-f93h-mc69-274w and OSV MAL-2026-18432 were published on 2026-11-01. The PyPI project is now quarantined. pypistats logged 221 downloads in the most recent day before the research run, so it was being installed before it was pulled. Remove the package and any .pth files it placed in site-packages, rotate every credential the affected host could reach, and block the IOC domain paleasbest.top named in OSV.
Do: Immediately uninstall pystr-codec and remove any .pth files it installed from site-packages (the PyPI project is quarantined, so it cannot be reinstalled); Rotate all credentials, tokens, SSH keys and secrets accessible from any machine or CI runner that installed it; Audit machines for persistence mechanisms and signs of spread or destructive actions; Check for exfiltration to public GitHub repositories and revoke exposed secrets; Block the IOC domain paleasbest.top (OSV MAL-2026-18432) and flag pystr-codec in dependency resolution; scan build environments for Miasma/testmetest indicators

### [critical] Malicious npm package dsh-screenshot-native — full system compromise on install
https://helix.ml/threat-watch/i/malicious-npm-package-dsh-screenshot-native-full-system-compromise-on-install · Supply chain · no-fix-needed · since 2026-11-01
GitHub's advisory database published a malware advisory for the npm package dsh-screenshot-native, version 1.0.0, flagged as CWE-506 embedded malicious code. Any machine with the package installed or running should be considered fully compromised, with control potentially handed to an outside actor; secrets and keys on affected machines must be treated as stolen. The package has no fixed or patched versions, so removal is the only option, and removal alone cannot guarantee the malicious software is gone. Reach appears limited (~566 downloads/month), but anyone who installed it is affected. No CVE; advisory GHSA-6f53-8jrf-3x9j published 2026-11-01.
Do: Remove dsh-screenshot-native from all projects and machines immediately; Rotate all secrets, keys, and credentials stored on affected machines, from a clean computer; Rebuild or reimage affected machines; do not assume removal fully cleans the system; Audit dependency lockfiles and CI environments for the package; Block the package name in internal registries and dependency scanning

### [critical] Malicious npm package @axon-web/icons 99.0.0 leaks hostname, username via OAST DNS beacon
https://helix.ml/threat-watch/i/malicious-npm-package-axon-web-icons-99-0-0-leaks-hostname-username-via-oast-dns-beacon · Supply chain · no-fix-needed · since 2026-11-01
OpenSSF and Amazon Inspector flagged the npm package @axon-web/icons version 99.0.0 as malicious, published to the GitHub Advisory Database on 2026-11-01 (GHSA-jh68-cxw4-pfj2). On require, index.js builds an identifier from os.hostname() and process.env.USER/USERNAME and performs a DNS lookup against a subdomain of an interactsh/OAST collector (oast.fun), leaking the installer's hostname and OS username to attacker-controlled DNS infrastructure. The same file enumerates process.env keys matching token, secret, key, pass, aws, github, and npm patterns and prints the matching key names to stdout, indicating reconnaissance of credential-bearing environment variables. The package contains no icon content and appears to be a dependency-confusion or typosquat payload. No patched version exists; the package should be treated as compromised and removed.
Do: Check lockfiles and dependency trees for @axon-web/icons@99.0.0 and remove it; treat any environment that installed it as potentially probed; Rotate credentials whose environment-variable names match token/secret/key/pass/aws/github/npm patterns on affected machines; Review DNS and proxy logs for queries to *.oast.fun subdomains to identify installations that beaconed; Audit for dependency-confusion exposure: pin internal-scope packages to private registries and enable npm provenance/integrity checks; Block the OAST domain in egress/DNS filtering

### [critical] hs-framework (npm): malicious package installs remote tarball from attacker-controlled GCS bucket, executing arbitrary code on install
https://helix.ml/threat-watch/i/hs-framework-npm-malicious-package-installs-remote-tarball-from-attacker-controlled-gcs-bucket-executing-arbitrary-code · Supply chain · no-fix-needed · since 2026-11-01
The npm package hs-framework (versions 999.9.1 and 999.9.2) was published with malicious code, flagged by OpenSSF and Amazon Inspector and recorded in the GitHub Advisory Database (GHSA-mmpx-xm69-xmv9) on 2026-11-01. The package's source is a one-line stub; its entire attack surface is a package.json dependency, ltidisafe, declared as a direct HTTPS tarball URL (https://storage.googleapis.com/lscunpentest/pack_ux_foundry.tgz) rather than a registry version range. On npm install, npm fetches whatever bytes are currently at that URL and installs them, running any lifecycle scripts they contain, with no version pin or integrity hash — so anyone controlling the bucket can change the executed code at any time. The bucket path 'lscunpentest' suggests penetration-testing framing. Any developer or CI system installing these versions executes attacker-controlled code. No patched versions exist; the fix is removal.
Do: Search lockfiles and dependency trees for hs-framework versions 999.9.1/999.9.2 and remove them immediately; Treat any machine or CI runner that installed these versions as compromised: rotate credentials, tokens, and secrets accessible to those environments; Audit for network connections or artifacts referencing storage.googleapis.com/lscunpentest/pack_ux_foundry.tgz; Block the bucket URL at egress controls and forbid HTTPS-URL dependencies in package.json via policy/linting; Prefer pinned registry dependencies with integrity hashes and enable npm audit/registry malware scanning in CI

### [critical] privacypass-py PyPI malware: credential-stealing beacon exfiltrates env secrets on install and import (no CVE)
https://helix.ml/threat-watch/i/privacypass-py-pypi-malware-credential-stealing-beacon-exfiltrates-env-secrets-on-install-and-import-no-cve · Supply chain · no-fix-needed · since 2026-11-01
The PyPI package privacypass-py, version 0.1.101, posing as 'Privacy Pass client primitives', contains no cryptographic functionality and is purely a data-exfiltration beacon. Its setup.py runs a _report() routine during build/install collecting hostname, username, cwd, argv, parent process command line, and credential-matching environment variables (AWS_, GITHUB_, PIP_, etc.), POSTing to http://85.190.112.236:8881/b/<nonce> over plain HTTP. On import, __init__.py repeats the beacon with expanded prefixes (CLOUDFLARE_, SUPERTOKENS, HOME, USER, PATH) and a substring filter (KEY/SECRET/TOKEN/PASS/CRED/PRIVATE/SEED/MNEMONIC/SIGNATURE/COOKIE/SESSION/AUTH), sending to /f/<nonce>. The import-time path fires outside pip build isolation. No fixed version exists; the package should be removed and exposed credentials rotated.
Do: Remove privacypass-py from all environments and dependency trees; Rotate any credentials whose env vars match the targeted prefixes (AWS_, GITHUB_, PIP_, CLOUDFLARE_, etc.) and any secrets matching KEY/SECRET/TOKEN/PASS/CRED/PRIVATE/SEED/MNEMONIC/SIGNATURE/COOKIE/SESSION/AUTH patterns; Block outbound traffic to 85.190.112.236:8881 and hunt logs for connections to it; Audit CI/CD and developer machines for installs/imports of the package and review pip logs for exposure; Pin dependencies and scan for typosquatting lookalikes of privacy-pass packages

### [critical] ConnectWise Cloud Backup: Storm-0940 used compromised app credentials and ARTEX to probe 2,250+ M365 tenants
https://helix.ml/threat-watch/i/connectwise-cloud-backup-storm-0940-china-linked-used-stolen-app-credentials-and-ai-pentest-tool-artex-to-access-2-250-m · Supply chain · partial · since 2026-10-15
ConnectWise says it found unauthorized access to application identities behind Cloud Backup (formerly SkyKick) on 14 Oct 2026, disclosed it on 16 Oct, and suspended Cloud Backup, SaaS Security and Cloud Management. Microsoft assesses that China state-aligned Storm-0940, active since 2021, was responsible, and that it used ARTEX, an open-source LLM-driven penetration-testing framework, to automate reconnaissance, password spraying and OAuth abuse. Before the ConnectWise identities were used, Storm-0940 sprayed 327 Microsoft 365 and Exchange Online accounts at eight organizations between 10 and 14 Oct; it logged no successful authentication in that phase. With the compromised application identities it then tried to sign in to more than 2,250 downstream tenants. Microsoft's campaign figures pair that with up to 2,900 attempts a minute, and say Storm-0940 reached privileged cloud persistence at many organizations across its ARTEX operations, some within three hours of targeting. Follow-on Graph activity included application credential changes and edits to identities, groups and privileged roles. ConnectWise says it has not confirmed downstream customer compromise and that its backup archives show no sign of compromise; Microsoft says sign-ins alone do not show that data was accessed or taken. No CVE is involved. The remedy is partly vendor-side (affected identities disabled, accounts reset, and a new ConnectWise Cloud Backup for M365 application that each tenant must re-authorize, restored in phases) and partly tenant-level review of OAuth applications, service-principal credentials and role changes. CrowdStrike tracks a separate China-nexus ARTEX campaign it calls VAPOR PANDA and says it is not Storm-0940 activity.
Do: Do not re-enable the previous ConnectWise Cloud Backup application connections. Re-authorize each Microsoft 365 tenant only through the new ConnectWise Cloud Backup for M365 application and ConnectWise's instructions. Backups resume only for re-authorized tenants, so confirm that new snapshots complete.; Review every Microsoft 365 tenant that ever authorized ConnectWise Cloud Backup, both your own and managed customers', from about 1 Oct 2026: service-principal sign-ins and Graph activity, application credential additions, OAuth consents, and changes to identities, groups and privileged roles.; Search sign-in and audit logs for 144.172.64.99 (Microsoft) and 144.172.64.128 (ConnectWise), and for the user agents Python-urllib/3.12 and python-requests/2.31. Do not limit the review to published IPs.; Preserve Microsoft Entra sign-in and audit records, Purview Audit, SIEM data and Graph telemetry before remediating.; Rotate credentials, and remove or re-authorize OAuth and enterprise applications that look suspicious, including credentials added to existing applications.; Harden against AI-automated password spraying: enforce MFA or 2SV, conditional access, and lockout and spray detection at scale.

### [critical] UpdraftCentral: stolen connection keys were used to backdoor WordPress sites (no CVE)
https://helix.ml/threat-watch/i/teamupdraft-updraftplus-updraftcentral-website-breach-exposed-connection-keys-used-to-install-backdoor-plugins-on-wordpr · Supply chain · patched · since 2026-10-19
TeamUpdraft says attackers got into its teamupdraft.com website over 17-18 October 2026 and reached a customer database holding names, contact and billing details, order history, hashed passwords, 2FA settings, and connection keys for UpdraftCentral, UpdraftVault and UpdraftClone. Patchstack reports that stolen UpdraftCentral keys were used to send plugin.upload_plugin commands that installed backdoor plugins on connected WordPress sites from 18 October; it counted 99 distinct backdoor plugin names, and the backdoors created rogue Editor-level accounts such as data-ops43. The cause is leaked keys, not a flaw in UpdraftPlus itself, which TeamUpdraft says is unaffected, as is self-hosted UpdraftCentral. The fix is UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later. Per the vendor, that release disconnects only connections made before 13:07 BST on 18 October; the 1.26.12 release was meant to do this but had a bug. Updating does not remove a backdoor that is already installed, and TeamUpdraft's 21 and 29 October updates say the incident is ongoing: a plugin the attacker left behind later created a new administrator account on a site that had already been disconnected. TeamUpdraft has reported the incident to the ICO and the police.
Fixed: UpdraftPlus 1.26.13 (free) / 2.26.13 (Premium)
Do: On every site that has ever had an UpdraftCentral connection, delete all connection keys in UpdraftPlus (Settings > UpdraftPlus > Advanced Tools > UpdraftCentral) before anything else, then update to UpdraftPlus 1.26.13 (free) or 2.26.13 (Premium) or later. 1.26.12 and 2.26.12 do not revoke keys. Keys created after the 13:07 BST cutoff are not revoked by the update, so delete them by hand.; Assume an update is not enough: check Plugins (including must-use) for unknown or hidden plugins and Users for unknown administrators or Editors. Known names include data-ops43 (display name 'Site Tools') and media-staff96, and the plugin names 'Site Health Cache' and 'Wp Forge'. Remove malicious plugins with a file manager or SFTP, not the WordPress dashboard, as the vendor advises; do not try to repair a backdoored plugin.; Search logs for IOCs: an UpdraftCentral log entry for probe.central.updraftplus.com followed by 'Command received: plugin.upload_plugin' (Patchstack); traffic from IPv4 43.250.53.42 or IPv6 2a09:bac5:4e21:2e3c::49b:9. If a backdoor is found, treat the site as compromised and restore from a backup taken before 17 October, as the vendor advises.; Change all WordPress administrator passwords and rotate the salts, reset 2FA, and change the teamupdraft.com password and any reused password (vendor advice).; Re-authorise linked remote storage and rotate its access keys for any site accessed through UpdraftCentral. UpdraftVault users reconnect sites with new credentials; UpdraftClone users copy new client keys from their account. Treat unexpected emails asking for credentials as phishing.

Breach data from Have I Been Pwned (haveibeenpwned.com) is licensed CC BY 4.0. Vulnerability data from the CISA KEV catalog and NVD.