This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. @hd-team/app-dnpkg-beta (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Judge assessment: This looks like a credential/exfil loader masquerading as a tiny npm package: the default entrypoint index.js contains a base64 blob that decodes to a JSON payload pointing at https://api.dq87771.com, which is not a legitimate package dependency pattern. The recovered security-holding content and the OSV malware advisory MAL-2026-14569 align with a compromised-package attacker model, not a benign library. The package metadata is also burner-like (brand-new-package, no repository, no description, single package under a fresh account), which strongly fits a malicious dropper published to harvest secrets or beacon out to a remote controller.

2. @7nohe/openapi-react-query-codegen (npm)

This legitimate package has been compromised by a threat actor using a GitHub actions worm-like attack.

References: https://github.com/7nohe/openapi-react-query-codegen/issues/217

3. @hd-team/app-dnpkg-prod (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Judge assessment: This package matches an attacker-controlled loader pattern: the entrypoint index.js is a base64-encoded blob that decodes to multiple hardcoded external URLs and tokens, which is far beyond normal package behavior. The recovered IOCs include six suspicious domains (apial.yrcmza.com, apial.qaffvz.com, apial.bengvet.com, api-al.wentian510.com, api.dq87774.com, apial.wentian510.com) embedded directly in the payload, indicating hidden command-and-control or exfil infrastructure. The metadata also looks like a disguised security-holding package (description: security holding package, hasSecurityHolding: true) published by npm-support, which is consistent with a compromised or maliciously seeded package rather than legitimate utility code. The attacker model here is a supply-chain implant intended to quietly execute hidden network interactions from consumers' machines, and the OSV advisory MAL-2026-14571 is corroborated by the actual decoded content.

4. @hd-team/app-impkg-prod (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Judge assessment: This looks like an attacker-controlled package intended to load a hidden payload and contact external infrastructure under the guise of a benign install. The entrypoint decodes into a JSON blob containing domain values https://api-prod.mlh99.com and https://api-prod02.mlh99.com, plus a token and an openFlag, which is not normal application bootstrap data and strongly suggests runtime command/control configuration. The package also has hasSecurityHolding with securityHoldingRecovered: true, indicating osmalyze found a concealed payload rather than a legitimate library, and the OSV MAL advisory aligns with a compromise model. The attacker model here is a supply-chain implant that activates on import via index.js and pulls remote configuration/C2 endpoints.

5. @hd-team/app-dnpkg-test (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Judge assessment: This is consistent with a credential-collection or command-and-control stub hidden inside a so-called "security holding package": the default entrypoint index.js contains encoded content that decodes to three attacker-controlled HTTPS endpoints (api.test.qiu577.com, api1.test.qiu577.com, api3.test.qiu577.com). The presence of recovered URLs in a base64-wrapped payload, combined with a package name like @hd-team/app-dnpkg-test and no source repository, strongly suggests an intentionally obscured loader rather than a normal library. The attacker model is a supply-chain compromise or dependency-confusion lure that phones home to external infrastructure under the qiu577.com domain family. The OSV advisory MAL-2026-14573 is corroborated by the actual hidden IOCs in index.js, so this should be treated as confirmed malicious.

6. @hd-team/app-dnpkg-three (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Judge assessment: This package matches a concealed-loader attacker model: the default entrypoint index.js contains encoded content that decodes into multiple hardcoded HTTPS endpoints on suspicious domains (.top, .xyz, .vip) plus repeated token fields, which is consistent with staged C2 or exfil infrastructure. The presence of security holding package and npm-support appears to be a camouflage label, but the recovered payload in index.js shows real URLs (https://apihw1.whhzckj.top, https://api.slzxkj.xyz, https://apihw1.fengniaokq.vip, https://api.njslzx.top) rather than benign placeholder data. The combination of encoded content, hidden IOCs, and a matching MAL advisory indicates this is not a false positive but a package intended to deliver or route traffic to attacker-controlled infrastructure.

7. @testrelic/playwright-analytics (npm)

This legitimate package has been compromised by North Korean theat actors for version 2.13.0. Versions before 2.13.x are safe. The compromised version of the scripts/postinstall.cjs has a PolinRider malicious JavaScript payload appended to the end of it.

NullReceiver npm supply-chain package containing a benign-looking postinstall configuration routine followed by an obfuscated blockchain-resolved payload loader. Analysis confirmed multiple downloaded JavaScript stages and dynamic execution behavior.

8. totp-utils (npm)

Package advertises itself as a TOTP utility but its postinstall script (node./index.js --setup 2>/dev/null || true) and its exported validateSecret API both invoke a hidden _run() routine that (1) scans Discord/Chrome/Edge/Brave/Opera LevelDB stores under os.homedir() for Discord auth-token regexes, DPAPI-decrypts encrypted tokens via a spawned powershell ProtectedData.Unprotect call, parses Minecraft launcher credentials (vanilla launcher_accounts.json, Lunar accounts.json, ModrinthApp app.db JWTs), validates the harvested Discord tokens against discord.com/api/v9, and POSTs the collected credentials to a hardcoded Discord webhook whose URL is stored as chunked base64 in _x and reassembled at runtime (Buffer.from(_x.join(''),'base64')) to a discord.com/api/webhooks/1532429233769419004/... endpoint; and (2) enumerates vanilla/Modrinth/Lunar Minecraft profile mods/ directories and writes an opaque JAR named optimized-renderer-1.0.0.jar (URL also stored as chunked base64 decoding to cdn.discordapp.com/attachments/1507484731535785994/1540335670831222894/optimized-renderer-1.0.0.jar) into each discovered mods folder, delivering unverified code that will execute the next time the user launches Minecraft with a Fabric loader. The postinstall suppresses stderr and uses a 4-second setTimeout to appear to finish cleanly. Because validateSecret (part of the three-function public API) schedules _run() via setImmediate, the same theft and dropper also fire whenever a downstream consumer imports the package and calls the advertised TOTP function — extending the attack surface well beyond install time.

Judge assessment: This is credential-stealing malware masquerading as a TOTP utility: index.js scans Discord, Chrome, Edge, Brave, and Opera LevelDB stores, DPAPI-decrypts protected values via a spawned powershell ProtectedData.Unprotect call, and validates harvested Discord tokens against discord.com/api/v9/users/@me before posting results to a hardcoded Discord webhook. The install path is also weaponized because package.json runs node ./index.js --setup in postinstall, so the theft executes on installation rather than requiring user interaction. The reconstructed IOC https://discord.com/api/webhooks/1532429233769419004/... and the second Discord CDN URL show a clear attacker model: exfiltrate secrets to a Discord-controlled C2 and stage additional payloads such as optimized-renderer-1.0.0.jar. The brand-new publisher account and rapid version spam reinforce that this is a likely dependency-confusion or supply-chain trojan, not a legitimate TOTP library.

9. auth-otp (npm)

This package targets Minecraft accounts to steal players' credentials. The package advertises itself as a zero-dependency TOTP/HOTP library, but package.json runs node lib/core.js --setup as a postinstall lifecycle script. lib/core.js first checks for CI/audit/pack indicators (CI, CONTINUOUSINTEGRATION, JESTWORKERID, missing APPDATA/USERPROFILE/USERNAME/COMPUTERNAME, npmlifecyclescript containing 'audit' or 'pack') and exits cleanly in those environments, so the payload only fires on real Windows developer machines. On a live host it enumerates Minecraft launcher account stores under %APPDATA% (vanilla launcheraccounts.json, Lunar accounts.json, Essential microsoftaccounts.json, CurseForge storage.json, ModrinthApp DB/JSON/LDB files, launchermsacredentials.bin) and extracts Xbox/MSA access and refresh tokens. It then scans Discord stable/canary/ptb/dev and Chromium-family browsers (Chrome, Edge, Brave, Opera, Opera GX) Local Storage leveldb files, uses PowerShell + Windows DPAPI to unprotect each browser's oscrypt master key, AES-256-GCM decrypts 'dQw4w9WgXcQ:'-prefixed token entries, validates them against https://discord.com/api/v9/users/@me, and POSTs the working tokens as JSON embeds (with @everyone) to a hardcoded Discord webhook whose URL is reassembled at runtime from seven string fragments to defeat plain-string scanners, resolving to https://discord.com/api/webhooks/1532429233769419004/VE9zx782_hy5vedls0lwNRAVA1sUGb9Q2chTdXdrcmXuNzztkeXe7Ilbt36OjWaNnTXe. The same postinstall path downloads a JAR (fabric-api-boost-1.0.0.jar) from a similarly split URL pointing at github.com/ghysghqgHUJ/.jar/releases/download/v1.0.0/ — a personal GitHub account unrelated to the package publisher, with no hash or signature verification — and stages it into the victim's Minecraft mods directory as a second-stage payload.

10. @syncraft-labs/core (npm)

npm package @syncraft-labs/core version 0.4.1 contains a PolinRider (DPRK/Lazarus, Contagious Interview cluster) payload injected into dist/index.js at publish time. This is a new obfuscation variant (hex/opcode packed, marker globalThis.i="A12-synd") using Ethereum JSON-RPC against legitimate public providers as its C2 channel, rather than the previously-documented TRON/trongrid.io channel. Version 0.4.1 remains live and installable on the npm registry (not unpublished).

References: https://registry.npmjs.org/@syncraft-labs/core/-/core-0.4.1.tgz

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com

Credits for the core data goes to https://opensourcemalware.com