This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. orderly-plugin-liquidity-heatmap (npm)

orderly-plugin-liquidity-heatmap poses as a liquidity heatmap plugin for the Orderly Network orderbook widget, but its only export is an empty stub and a postinstall hook runs node ./scripts/setup.js on npm install. When the script detects GitHub Actions (CI and GITHUBWORKSPACE set), it records the runner's host, user, repository, GITHUB/ACTIONS/RUNNER variable names, GITHUBTOKEN presence and length and network egress, and requests an OIDC token from ACTIONSIDTOKENREQUESTURL. From 1.0.2 it uses the workflow's GITHUBTOKEN to commit heatmap-setup-report.json to the default branch of the installing repository, and 1.0.4 also force-pushes a heatmap-setup-<timestamp> git tag with the credentials actions/checkout persists in .git/config; 1.0.6 ships the same setup.js as 1.0.4. The npm account dumtban published the six versions between 13:12 and 16:05 UTC on 2026-10-11, each extending the previous one's access to the CI runner.

2. @apexacc/cli (npm)

Malicious from first publish: 'Apex Copilot' repackages the Oh My Pi coding agent, routes OpenRouter LLM traffic through attacker-controlled arena.apexaccs.org, registers a persistent attacker MCP server, and runs server-supplied commands from vrf.apexaccs.org that install the CloudSyncD backdoor on macOS and a Telegram-exfiltrating infostealer on Windows. Distributed by the fake 'Apex Accelerator' targeting crypto founders.

References: https://www.elastic.co/security-labs/threat-command/apex-accelerator-malicious-npm-packages

3. @xxxfnbs21/hello-demo (npm)

The package presents a benign npm entrypoint (lib/index.js is a trivial greeting function) while the build/index.html file contains a sophisticated browser fingerprinting payload that exfiltrates environment data to an attacker-controlled Alibaba OSS endpoint. The ping() function collects WebDriver detection (wd), CEF/Electron detection (cef: typeof window.cefQuery), detailed Chrome version fingerprinting via 19 API probes, high-entropy UA values (architecture, platform version, full browser version list), WebAssembly support, and eval capability — a profile consistent with targeting specific developer environments or CI pipelines rather than general analytics. The embedded TurboFan JIT bug probe (chk-15903) and the console.log verdict-capture hook further indicate active exploitation research, not a demo widget. npm has already flagged this as a security holding and an OSV advisory (MAL-2026-17876) exists; the code-level evidence corroborates the advisory's concern, though the claimed full compromise overstates what is visible here (no credential theft or install hooks were found — the malicious payload only executes in a browser).

4. passwordcrackv2 (npm)

passwordcrackv2 poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs try{module['require']('node-net-pool')}catch(_){} to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists through HKCU Run/RunOnce, UserInitMprLogonScript and a Startup shortcut, and re-checks for updates every two hours. Amazon Inspector reported the same loader stub in discord-mfa-solver (MAL-2026-16100). The npm account kingsize published passwordcrackv2 and passwordcracker with identical code on 2026-10-09 and 2026-10-10.

5. curse-allies-module (npm)

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution.

6. webpackbootstrap5 (npm)

[email protected] typosquats bootstrap and ships a disguised in-browser proxy kit. Its bundled loader (index-z2b7r4.js) XOR-decodes a list of endpoints with a fixed key and injects remote scripts from https://dyingefforlessefforlessours.com via document.head.appendChild, then boots a Scramjet/wisp WebSocket proxy that routes page traffic through operator-controlled relays. The loader matches (same sha256) sibling packages webpackbootstrapscripts and @zaka13/thing by the same publisher (zaka13). Harm is browser-side when the asset is served; no install script runs.

7. passwordcracker (npm)

passwordcracker poses as a dependency-free Discord MFA library but pulls node-net-pool from the attacker's GitHub repo lunexindonesia/node-net-pool, and on load lib/cache.js runs try{module['require']('node-net-pool')}catch(_){} to execute it. On Windows, that index.js downloads a script from a limbomail.com attachment URL, saves it as a hidden winsvc.js under %APPDATA%, %LOCALAPPDATA% or %TEMP%, runs it via a hidden WinSvcHost.vbs, persists through HKCU Run/RunOnce, UserInitMprLogonScript and a Startup shortcut, and re-checks for updates every two hours. Amazon Inspector reported the same loader stub in discord-mfa-solver (MAL-2026-16100). The npm account kingsize published passwordcracker and passwordcrackv2 with identical code on 2026-10-09 and 2026-10-10.

8. ap3-foundations-ui (npm)

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution.

9. tellyo-colours (npm)

This package installs a malicious NPM package from the same author.

10. @dransay/api (npm)

@dransay/[email protected] is a dependency-confusion probe claiming the internal @dransay/* namespace, not an identified public package. Its preinstall hook runs on npm install as node beacon.js and sends a DNS lookup and an HTTPS GET to db3klhbi6i9hark1kegg174t38h33b6wt.oast.site, using the package name in the request; npm account 0xamino_hunter published it on 2026-10-08.

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com

Credits for the core data goes to https://opensourcemalware.com