This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. spoint (npm)

This appears to be a very VERY sneaky account compromise that introduces an infostealer. Versions 0.1.695 to 0.1.700 add two additional dependencies: node-fetch and dotenv. These two new dependencies were added to allow the threat actor to exfiltrate the API keys the game server is talking to.

2. agentgui (npm)

This is a confirmed supply-chain compromise of a legitimate package. APT malware detected: PolinRider, nullreceiver. Associated with threat actor(s): DPRK/Lazarus. Behaviours: data exfiltration, code execution, network activity, obfuscated code, install-time execution.

3. @guangnao/agent-proxy (npm)

On invocation of agent-proxy start, the CLI opens an outbound WebSocket to an obfuscated author-controlled endpoint (hub.client-llm.com, reconstructed at runtime via XOR+base64 with key 'gnP2p!7xQ' from a base64 blob in dist/cli.js) and accepts remote job messages containing arbitrary path and body fields. These are POSTed into the local proxy and forwarded to api.anthropic.com and the Codex/ChatGPT upstream using the installer's on-disk OAuth credentials, with responses streamed back to the hub. An onlyIfCredentialed gate ensures only installers with valid Claude/Codex logins are enrolled as worker nodes serving requests originated by the hub operator. The behavior is undocumented; the README states the tool is 'self-use only' and warns that upstream vendor ToS forbid resale or sharing of accounts. The destination URL is not present as a plaintext string, only reconstructed at runtime, concealing it from casual review. The combination provides a remote-controlled command channel (arbitrary request path/body) into the installer's authenticated AI session and silently monetizes the installer's paid subscription for the hub operator's traffic.

Judge assessment: This is consistent with a remote-controlled proxy/worm that enrolls the installer as a worker node and forwards authenticated AI traffic through an operator-controlled hub, not a normal local utility. The reconstructed exfil endpoint http://127.0.0.1:message/v1/messages

4. @kolbo/mcp (npm)

This is a confirmed supply-chain compromise of a legitimate package. Version 1.57.1 has been self-deprecated by the maintainer with an explicit backdoor warning. The src/auth.js file contains a trojanized payload hidden after module.exports behind hundreds of whitespace characters — classic trojanized-package concealment. The hidden code uses unicode-escaped require calls (\u0068\u0074\u0074\u0070 → 'http', \u0063\u0068\u0069\u006C\u0064\u005F\u0070\u0072\u006F\u0063\u0065\u0073\u0073 → 'child_process') to load modules without detection, sets global['r']=require and global['_V'] (a confirmed PolinRider/DPRK-Lazarus campaign marker), and contacts Ethereum RPC endpoints (https://eth.blockscout.com/api, https://1rpc.io/eth, https://eth.drpc.org) decoded from unicode-escaped strings — consistent with crypto-wallet draining or blockchain-based C2. The payload also includes a hardcoded Ethereum address (0xa322E5f3D311D3080e6f01210635e9aDC2490Ef1a) and spawns child processes. The campaign-polinrider rule match plus the maintainer's own deprecation notice leave no ambiguity.

5. @bikli/cli (npm)

Part of the bikli supply chain attack. Pretends to be AI agent platform with Windows specific installer.

6. @caspianph/first-npm-package (npm)

This is someone figuring out a simple but unique way to skip scanning of package manifests: rewrite a template package.md file into a package.json file with a postinstall script. Smart, but noisy, yo.

7. @dreamguyxeon/baileyx (npm)

This package is consistent with an attacker-controlled WhatsApp/Baileys fork that installs a preinstall hook and then hides payload logic behind heavy obfuscation, debugger traps, and encoded strings. The strongest indicator is the custom exfiltration path: lib/Socket/socket.js is classified as update.me / mmg.whatsapp.net custom-C2 and explicitly base64-encodes credential material like creds.noiseKey.public and creds.signedIdentityKey.public, which matches credential-and-session theft by a malicious publisher. The package.json preinstall of node ./engine-requirements.js guarantees code execution on install, and the attacker model here is a supply-chain implant publisher shipping a trojanized Baileys build to steal WhatsApp session data and route it to attacker infrastructure. The obfuscated files (lib/index.js, lib/WABinary/encode.js, lib/Socket/messages-send.js) and the suspicious domain set (update.me, creds.me, sock.ws) reinforce that this is not normal library minification but concealment of malicious behavior.

8. @mexc/shared-utils (npm)

This package is a self-described security research PoC to see if the @mexc namespace can be claimed.

9. fsbrowse (npm)

This is a minimal HTTP file server package (fsbrowse) with a well-established publisher (261 packages, zero prior malicious packages). The flagged findings are all false positives in test files: encodeURIComponent is standard URL encoding for file paths in an HTTP file server, new Function('return ' + ...) in test files is a common pattern for evaluating JSON-like expressions in test assertions, and POST method usage is straightforward HTTP API testing. The 'corporate-targeting' rule fired on test function names like testMkdirTraversal and testServerBasepathEnv, which are clearly security-oriented test cases verifying path traversal protections. The only IOC is http://localhost:3000, a test endpoint. The entrypoint (bin.js) is clean CLI argument parsing with no network calls, and there is no exfil path, no obfuscation, and no suspicious IOCs.

10. specials-resources-server (npm)

This package implements a classic staged dropper. The entrypoint index.js loads both lib/telemetry.js and _shim.js on import. _shim.js fetches a platform-specific binary from a set of obfuscated C2 endpoints (, and a DNS-TXT channel via wel1.ru domains), writes it to a temp directory under a disguised name (dotnetdiag.exe on Windows, .cache_ on Linux/macOS), marks it executable, then launches it as a detached background process with stdio suppressed so it survives the parent process and produces no visible output. The DNS-over-TXT fallback channel (txtFetch via et al.) is a sophisticated exfil-resilience mechanism used by advanced supply-chain malware. The description 'security holding package' is a social-engineering cover; the package was published one day ago with no repository, no author, and version 35.8.1 implying a fake legitimacy signal. The attacker model is supply-chain binary dropper: infect developer machines at npm install time, deploy persistent cross-platform implant.

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com

Credits for the core data goes to https://opensourcemalware.com