This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. tensorlake (npm)

Version 0.5.144 of the tensorlake npm SDK was published with a preinstall hook that runs an obfuscated loader, which launches a credential-stealing, self-propagating payload. Socket links it to the Shai-Hulud / ChainDrop campaign.

2. qwen3ttsui (pypi)

This package is a purpose-built remote-code-execution loader: on import it fetches arbitrary Python source from a caller-supplied URL, compiles it, and executes it in-process via exec(compile(src, …)). The design is structurally identical to a dropper — the only thing separating 'framework' from 'malware' is what the server eventually serves.

To that last point, currently this package is defanged and does not call a payload from a real, functioning url. However, taking this behaviour as a whole, we are flagging this as a low, because the authors package description does not match what the code is actually doing. Add to that the fact that if the author adds a malicious url to this package it suddenly becomes a much more immediate threat.

3. @firedmosquito831/my-claude-code (npm)

postinstall hook executes remote second-stage code at install time: runtime-install.js:609 does curl ... | sh and lines 597-603 run remote PowerShell via irm with -ExecutionPolicy Bypass, from a GitHub raw URL outside any verified registry artifact. It also strips macOS quarantine on downloaded binaries (runtime-install.js:545), enabling unsigned code execution; the 'digest-verified' claims appear only in comments, not in the executed code path.

References: https://www.npmjs.com/package/@firedmosquito831/my-claude-code

4. @subql/common (npm)

On October 5, 2026, a malicious version of the @subql/common package, version 5.8.3, was published. It adds a postinstall script that runs manifest-cache.js. The file decodes a large obfuscated blob (base64, rolling XOR, and gzip), then executes it with new Function in a detached, silent process with access to the full environment. A new maintainer published the release without provenance. The same code also runs when the package is imported. Treat this as a supply-chain compromise.

5. @bellaxchuu/libsignal-node (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

6. dzyclutch-baileys (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

7. claudecord (pypi)

This package is designed to look like a AI agent orchestration tool, but really this repository/package snapshot contains a malicious GitHub Actions CI workflow designed to steal deployment, SSH, npm, and PyPI credentials. It also creates a credible path for publishing trojanized future releases and compromising the deployment server.

Published by

8. pxnpm (npm)

pxnpm 7.0.0-beta.6, 7.0.0-beta.8 and 7.0.0 (published 2026-10-06 by user nfjbill) are a 10-file, 16 KB launcher for a native executable that is not contained in the package. The postinstall script (bin/install.cjs) calls ensureNative() in dist/download.cjs, which downloads a 17-21 MB Brotli archive for the current platform from a non-npm host, https://registry-pxnpm.rdc.nfjbill.ren:20021/_static/srv/downloads/pxnpm//-.br, decompresses it into a 52-72 MB executable under ~/.cache/pxnpm/native///, sets mode 0755, and the launcher (dist/launcher.cjs line 54) later runs it with childprocess.spawn. The manifest (dist/native-manifest.json) sets networkPolicy 'fixed', so the environment variables that would let a user supply a reviewed binary or a different download location are ignored; the archive and the executable are verified only against hashes shipped in the same package.

When run, dist/launcher.cjs prepare() deletes every registry and proxy setting from the user's environment (npmconfigregistry, scoped registries, http(s)proxy, noproxy and the pnpm/pxnpm equivalents), rejects --registry and --proxy flags, and forces PXNPMCONFIGREGISTRY to https://registry-pxnpm.rdc.nfjbill.ren:20021/ and PXNPMCONFIGPROXY, HTTPSPROXY and HTTPPROXY to an authenticated proxy URL on the same host, port 20022 (a gost proxy), that is embedded in the file as a base64 string with the comment 'Filled only in the release staging directory; never store credentials in Git'. All package traffic of a user of this public package is therefore routed through the author's host, which can observe and alter it.

Nothing in the package name, the one-line README or the install output discloses that an executable will be fetched from a private host or that registry and proxy settings will be replaced. The JavaScript itself contains no data collection and no obfuscation beyond the base64 string. At the time of this report the download URL returns a 430-byte npm registry JSON document instead of the archive, so installation from outside the author's network fails at the checksum step and the executable could not be examined; its behavior is unknown. The same host is the hard-coded endpoint of yakuza0 2.23.40 by the same author (MAL-2026-13605).

Trigger: on install (postinstall) and on every run. Type: silent install-time download and execution of an unreviewable binary from a private host, with hijacking of registry and proxy settings.

9. wie888r (npm)

[email protected] ships a stub main (index.js) that exports a Proxy returning no-op functions for any property access, so bundlers that resolve this name do not crash. The package's postinstall script runs beacon.cjs, which collects host identifiers (hostname, install path, cwd, node version) and POSTs them to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plain HTTP. index.js invokes the same beacon on require, so the exfiltration fires both at install time and whenever the module is loaded. The destination is not a documented first-party service, and the package's self-described 'compatibility shim' purpose is contradicted by the beacon behavior. The combination of a no-op Proxy stub, a hardcoded non-publisher bare-IP endpoint, and dual install-time plus import-time reconnaissance is the standard shape of a dependency-confusion / typosquat probe used to confirm resolution of an unexpected name inside a target environment.

10. xblaxw (npm)

[email protected] is a stub package whose only behavior is a beacon. The package.json postinstall script runs node beacon.cjs, which collects host identifiers (hostname, install path, process.cwd(), process.version) and POSTs them as JSON to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc over plaintext HTTP. The same beacon is re-fired on require(): index.js exports a Proxy that returns a no-op function for any property access and calls require('./beacon.cjs').fire() on load, so the exfiltration also triggers whenever a consumer imports the package. The package description is 'Compatibility shim.' with no real functionality — the Proxy-of-noops export is consistent with a dependency-confusion / name-squat beacon designed to confirm which internal names resolve to this public package and report back installer host metadata to the operator at 185.158.107.175:8787.

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com

Credits for the core data goes to https://opensourcemalware.com