This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. @crysnovax/baileys (npm)

@crysnovax/baileys is a renamed fork of the Baileys WhatsApp Web library. On every successful connection (connection.update with connection === 'open', wired in lib/Socket/socket.js) it silently makes the user's own authenticated WhatsApp account follow two channels controlled by the publisher, 120363402922206865@newsletter and 120363423670814885@newsletter, through the xwa2newsletterjoin_v2 FOLLOW query, with no opt-out and a creds.additionalData.crysnovaxFollowed once-flag. From 2.7.10 the module that performs the follow (lib/Utils/channel-policy.js) is the only file in the package run through javascript-obfuscator (declared as a devDependency with an 'obfuscate' npm script); pkgwarden re-implemented the rotated string-table decoder to recover the channel ids without executing the code. Separately, from 2.7.6, lib/Utils/integrity.js POSTs the package name and version plus a SHA-256 machine fingerprint to https://bailey.crysnovax.link/api/v1/verify on every connect (a publisher-controlled kill switch that fails open), and the update check is repointed to web.crysnovax.link. Earlier versions (1.0.3 through 2.7.5) carry the same forced follow in plaintext with a comment calling it a 'condition of use'; they are not listed here. The listed versions combine the concealed follow with the fingerprint phone-home. Reachability was confirmed by following the socket chain from makeWASocket. No credential or session-key theft was observed. All listed versions were fetched from the npm registry and read by hand on 2026-09-03; the current latest tag (2.8.3) is armed. Related family: MAL-2026-13932 and MAL-2026-15819 (Baileys-fork newsletter auto-follow campaign).

Judge assessment: This package implements a publisher-controlled malware pattern: on install it runs engine-requirements.js, and at runtime lib/Utils/integrity.js phones home to https://bailey.crysnovax.link/api/v1/verify with a SHA-256 machine fingerprint and package identity, matching the attacker model of remote attestation/kill-switch enforcement. The obfuscated lib/Utils/channel-policy.js and the deobfuscated IOC recovery (iocs-recovered, recoveredIocCount: 10) align with concealed behavior rather than a benign library, and the OSV advisory’s forced newsletter follow is corroborated by the hidden IOCs and obfuscation. The presence of persistence-like .profile hooks plus data-exfiltration-encoding and dynamic-code-execution findings further supports adversarial intent in a renamed Baileys fork, not just odd library code. I would treat this as a compromised/abusive supply-chain package from a malicious publisher model that silently enforces publisher actions and contacts publisher infrastructure.

2. test__123q1 (npm)

The package declares a postinstall hook (node dist/script.js) while its declared main entry (dist/index.js) is an inert 105-byte stub, so the entire behavior fires at npm install time. The postinstall script walks the installer's home directory and common workspace folders (Desktop, Documents, Downloads, Projects, Backups) and (1) reads browser wallet extension profiles for MetaMask, Phantom, Trust, Coinbase, OKX, Rabby, Keplr, Solflare, TronLink, Ronin, and Exodus, along with desktop wallet stores for Exodus, Electrum, Bitcoin Core, Ledger Live, Trezor Suite, Wasabi, and Sparrow, plus any files matching seed/mnemonic/bip39/privatekey/keystore keywords; (2) enumerates a hardcoded list of sensitive files including .env*, .npmrc, .yarnrc, .pnpmrc, .netrc, .git-credentials, .gitconfig, id_rsa/id_ed25519/id_ecdsa, .pem/private.key, aws.json, gcloud.json, service-account.json, and firebase-adminsdk.json. Collected material is packaged with tar and uploaded to a hardcoded Telegram bot endpoint at https://api.telegram.org/bot<BOT_TOKEN>/sendDocument. The script additionally harvests the installer's npm auth token, writes //registry.npmjs.org/:_authToken=${token} into an .npmrc, queries registry.npmjs.org/-/whoami and registry.npmjs.org/-/v1/search to enumerate the victim maintainer's other packages, and copies its own dist payload into them via fs.cp('dist', pathToInject, { recursive: true }) to republish malicious versions under the victim's identity.

Judge assessment: This is a clear installer-time credential-theft and exfiltration package consistent with a supply-chain attacker model: the postinstall hook runs node dist/script.js, and the script targets wallet files, .gitconfig, and other secrets before uploading them to a Telegram bot endpoint. The reconstructed URL https://api.telegram.org/bot8703948693:AAHFPSbnGc_Y9XcX3T2ih5vLCDwxndYYmOA/sendDocument plus data-exfiltration-encoding and git-config-access shows real exfiltration behavior, not a benign telemetry library. The crypto-wallet-theft and chai-max-indicators findings reinforce that the payload is designed to steal cryptocurrency wallets and matches a known malware campaign pattern. The new burner-like publisher metadata (testnpm_testnpm, 2-day-old account, three near-duplicate packages) and the OSV advisory’s supply-chain replication claim further support malicious intent.

3. @systemzero/baileys (npm)

This package is consistent with an attacker-controlled remote-command channel embedded in a WhatsApp bot fork: the OSV advisory identifies a hardcoded SIGNAL_STREAM_URL at https://zone.api.br/api/owner/whatsapp-signal-stream and a socket entrypoint that unconditionally subscribes to it. The static findings reinforce active abuse, including download-execute-delete, dynamic-code-execution, startup-persistence, and multiple data-exfiltration-encoding hits, which together fit malware that can execute payloads, persist, and exfiltrate session data. The likely attacker model is a supply-chain compromise of a dependency used by bot operators to silently commandeer authenticated WhatsApp sessions and push attacker-chosen actions. engine-requirements.js is only a Node version gate, but it does not mitigate the far more serious lib/Socket/messages-send.js and lib/Utils/signal-stream.js behavior.

4. telemetry-helper (pypi)

On import telemetry_helper, top-level code starts a daemon thread that sleeps 30 seconds and then POSTs a JSON payload containing the hostname, username, current working directory, and the entire process environment (dict(os.environ)) to a hardcoded webhook.site inbox at https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4. os.environ on developer and CI hosts routinely contains credential-grade variables (AWSACCESSKEYID / AWSSECRETACCESSKEY, GITHUBTOKEN, NPMTOKEN, PYPITOKEN / TWINEPASSWORD, database URLs, private keys), so this is a bulk credential and host-identity harvester. The destination is an anonymous third-party webhook inbox unrelated to any declared publisher, and the 30-second delay before the POST is consistent with evasion of short-lived install/import sandboxes. The behavior fires unconditionally at import with no opt-out and no relation to any advertised functionality.

In this campaign, one package contains malicious code exfiltrating environment variables during import (telemetry-helper), and another one intentionally installs it as a dependency.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-telemetry-helper

Reasons (based on the campaign):

  • exfiltration-env-variables
  • The malicious code is intentionally included in a dependency of the package

Judge assessment: This is a straightforward import-time infostealer: telemetry_helper/__init__.py calls send_ping() at module import, builds a payload with socket.gethostname(), os.getlogin()/os.environ.get('USER'), os.getcwd(), and the full dict(os.environ), then POSTs it to a hardcoded webhook.site inbox. The attacker model is credential harvesting from developer and CI hosts, since os.environ routinely contains secrets like cloud keys and tokens, and the code disables TLS verification with verify=False to ease exfiltration. The MAL-2026-15829 advisory is corroborated by the actual source and the recovered IOC https://webhook.site/e32d3b8a-a5df-40cc-ae60-7a8343b581e4, so this is not a benign telemetry helper. The minimal metadata and no repository support the assessment that this is a throwaway malicious package rather than a legitimate published library.

5. tsshare (pypi)

This package is a credential-harvesting supply chain attack targeting users of the Tushare financial data API. It presents as a 'drop-in replacement for pro_api' to intercept user auth tokens: every query() call POSTs the user's auth_code plus a hardware device fingerprint to https://fszzw56.com (a custom C2 domain hidden via base64 encoding as _E = b"aHR0cHM6Ly9mc3p6dzU2LmNvbQ=="). The hardware fingerprinting is elaborate and cross-platform — it silently runs PowerShell Get-CimInstance Win32_Processor/Win32_DiskDrive, system_profiler SPHardwareDataType, and reads /etc/machine-id, all with stderr=subprocess.DEVNULL to suppress output. The C2 URL obfuscation is a deliberate evasion technique: the domain is never present as plaintext in source, only decoded at runtime. The rapid version-burst pattern (11 versions in a single day on 2026-07-21) and a single-package publisher with no repository are consistent with an active attacker iterating on deployment.

6. mfafix (npm)

lib/cache.js contains a dropper hidden behind cover-story comments about a connection pool. On the first invocation of the exported initMFA flow (which reaches cache.get() via mfaStore.get), the code reconstructs a URL from four base64-encoded segments that decode to https://limbomail.com/api/attachment/…, downloads a JavaScript payload, writes it to %APPDATA%\Microsoft\Windows\WinSxS\Backup\WinSvcHost.js, and launches it under the host Node.js executable via childprocess.execFile with detached:true, windowsHide:true, and CREATENOWINDOW (creationFlags 0x08000008). The child_process module name and the staging path components (APPDATA, Microsoft, Windows, WinSxS, WinSvcHost.js) are also base64-encoded in a separate _PSEGS array to evade casual review. The destination host limbomail.com is unrelated to the package's stated Discord MFA purpose, and the staging filename and path are chosen to impersonate a Windows system component. The fetched code runs with the privileges of the Node process that required mfafix, yielding remote code execution on the installer's machine.

Judge assessment: This is a remote-code dropper for a likely attacker-controlled publisher, not a Discord MFA helper: lib/cache.js reconstructs https://limbomail.com/api/attachment/..., downloads a JavaScript payload, writes it into a Windows-style hidden staging path, and launches it with execFile(process.execPath, [p], { detached: true, stdio: 'ignore', windowsHide: true, creationFlags: 0x08000008 }). The attacker model is a supply-chain compromise or dependency-confusion loader that gains arbitrary code execution on the victim’s machine when the package’s cache path is first touched. The package also exfiltrates system information and uses encoded/obfuscated strings in both index.js and lib/cache.js, while the publisher has a prior malicious package (mfacord) and a brand-new account. The OSV advisory’s description is directly corroborated by the code paths and recovered IOC limbomail.com, so this should be treated as confirmed malicious.

7. npx-oob-package (npm)

This looks like a deliberate dependency-confusion/OOB beacon package whose attacker model is to enumerate the installing user and silently report it to the publisher. The entrypoint bin/cli.js hardcodes a url, gathers whoami, os.hostname(), and os.platform(), and POSTs them with an npx/${name} user agent. It also executes whoami via execFileSync, which is unnecessary for a normal package but consistent with environment fingerprinting and exfiltration. The package metadata is additionally suspicious — very new account, rapid version spam, and no repository — and OSV advisory MAL-2026-15597 corroborates the malicious behavior.

8. test__123q2 (npm)

On npm install, the package's postinstall script sweeps the installer's home directory for crypto wallet and credential material and uploads it to an attacker-controlled Telegram bot. Targets include browser wallet extension profiles for MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), Phantom, Trust, Coinbase, OKX, Rabby, Keplr, TronLink, Ronin, Solflare and Exodus; desktop wallets Exodus, Atomic, Electrum, Bitcoin Core (wallet.dat), Ledger Live, Trezor Suite, Wasabi, Sparrow, Guarda, Coinomi and Jaxx; and files under Desktop, Documents, Downloads and Projects matching mnemonic/seed/bip39/privatekey keywords plus.env,.npmrc,.netrc, id_rsa and ~/.aws material. Collected files are tarballed via the tar dependency and POSTed as a document to a hardcoded Telegram Bot API endpoint (https://api.telegram.org/bot/sendDocument); the destination is not user-configurable. The package name and version carry no legitimate functionality that would justify this behavior.

Judge assessment: This is a credential-and-crypto-wallet stealer delivered via an npm postinstall hook, consistent with a malicious installer targeting developers' home directories. The entrypoint dist/script.js explicitly enumerates browser wallet profiles and desktop wallets such as MetaMask, Phantom, Bitcoin Core (wallet.dat), and Electrum, while also probing sensitive files like .gitconfig, .env, .npmrc, and id_rsa. Exfiltration is hardcoded to a Telegram Bot API endpoint (https://api.telegram.org/bot8703948693:AAHFPSbnGc_Y9XcX3T2ih5vLCDwxndYYmOA/sendDocument), and the chai-max-indicators finding corroborates a DPRK/Lazarus-style stealer campaign. The new burner publisher account and package metadata reinforce that this is not legitimate telemetry but an attacker-controlled install-time theft operation.

9. randomunblockedwebsite (npm)

The npm package [email protected] contains obfuscated browser-proxy functionality disguised among approximately 26 MB of copied Cosmos chain-registry data. Its bundled HTML and SVG entry points masquerade as an educational tutoring website while dynamically downloading and executing JavaScript from the GitHub-backed jsDelivr path cdn.jsdelivr.net/gh/TongSherbet/storage/.

When either browser document is opened, it injects a remote loader.js script with an hourly cache-busting query parameter. Bundled service-worker files separately import the remote jet/jet.sw.js payload, claim browser clients, intercept requests, and pass selected traffic to a remotely supplied Scramjet proxy controller.

The service worker can delete the _scramjetcontroller IndexedDB database, delete all Cache Storage entries for the affected origin, unregister itself, and reload controlled browser windows. The remote scripts were not retrieved, so downstream data collection, additional payload delivery, and proxy behavior remain unresolved. No direct credential theft, native command execution, cryptocurrency transactions, or operating-system persistence was identified in the locally available files.

The package’s declared npm entry point also attempts to proxy an HttpProvider from an undeclared package named supersignature. In the analyzed version, that branch is broken because it calls an undefined loadHttpProvider() function, making the dynamic import unreachable through the exported API.

10. node-net-pool (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com

Credits for the core data goes to https://opensourcemalware.com