This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. aurenatts (pypi)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.
  • other

Judge assessment: The package implements a transparent remote-code-execution loader: on import, load() fetches an arbitrary Python source file from a caller-supplied URL via urllib.request.urlopen, writes it to a temp directory, then executes it in-process with exec(compile(src, ...)). The docstring even provides a worked example pointing to the exfil/loader URL. There is no sandboxing, signature verification, or scope restriction — whatever the remote server returns is executed with full interpreter privileges. The attacker model is a supply-chain loader: the package itself carries no payload, but any downstream code that calls run(url=...) (or sets AURENATTS_PROFILE) immediately fetches and executes attacker-controlled Python. The metadata profile (brand-new single-version package, no repository, novel author with zero prior packages) is consistent with a campaign-placed loader. The OSV advisory corroborates this as part of a coordinated 2026-10 campaign.

2. @tekmidian/pai (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

3. prosodinetts (pypi)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.
  • other

Judge assessment: The package implements a remote code execution loader: on import or explicit call, it fetches an arbitrary URL via urllib.request.urlopen, compiles the response with compile(src, mod.__file__, 'exec'), and executes it in-process via exec(). The hardcoded example URL in the docstring (https://example/serve/eval-profile.py) is classified as a C2 role by the IOC classifier. The package description ('tiny, standard-library-only runner for remote profiles') is a deliberate social-engineering frame to make the loader pattern seem legitimate. No obfuscation is needed because the payload is fetched at runtime from an attacker-controlled server, making static detection harder. The package has no repository, a single version, is newly published, and belongs to a named campaign of coordinated loader packages — all consistent with a supply-chain attack delivering stage-2 malware.

4. codecraze (pypi)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.
  • other

Judge assessment: The package implements a remote code execution loader that fetches arbitrary Python source from a caller-supplied URL and executes it in-process via exec(compile(src, ...)). The entrypoint codecraze/__init__.py exposes a run() function that calls _fetch(url) to download the payload and then executes it unconditionally, with no signature verification, sandboxing, or content validation. The hardcoded example URL in the docstring (https://example/serve/eval-profile.py) is classified as a C2 endpoint in the IOC analysis, and the package's sibling dictanovaasr follows the identical pattern under a different audio/speech-recognition cover story, confirming a coordinated campaign. The metadata profile — brand-new publisher, single version, no repository, two packages published simultaneously — is consistent with a supply-chain campaign designed to slip loader stubs onto victim machines via transitive dependency confusion or typosquatting. The code itself is the complete and functional attacker infrastructure for stage-1 remote payload delivery.

5. melcuratts (pypi)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.
  • other

Judge assessment: The package is a remote code loader that, on import or explicit invocation, fetches an arbitrary Python script from a caller-supplied URL and executes it in-process via compile()+exec(). The entrypoint file confirms the full loader pipeline: _fetch() downloads the remote payload, load() compiles and execs it inside a freshly created module, and run() calls its entry point. The example URL hardcoded in the docstring points to a suspicious non-standard host. There is no sandboxing, signature verification, or integrity check — whatever the remote server returns is executed with full process privileges. This is a generic remote-code-execution loader, consistent with a campaign of deceptive 'voice synthesis profile' packages designed to deliver a second-stage payload without embedding it in the package itself. The OSV advisory corroborates this as part of a coordinated campaign.

6. @sudobility/wildduck_client (npm)

This account appears to have been compromised by a maliicious threat actor, although we haven't been able to verify this yet as the package author has not responded to our questions about how this happened. Regardless, at least five packages by this author had out of band malicoius versions published to NPM.

The postinstall hook sh scripts/miner.sh executes automatically on every npm install. The IOCs recovered in plaintext confirm the attacker model: a hardcoded Monero wallet address, an AWS access key (AKIAUHL4Y2TJZ7L7AE3F) used to authenticate S3 downloads, and the version itself is deprecated with an explicit note that it was published from a compromised npm token. The miner.sh script fetches a gzip payload from an attacker-controlled S3 bucket and deploys either a persistent agent with cron/tor-channel or the bundled bin/miner-linux-amd64 XMRig binary, configured to connect to the XMRig pool at networkservicesupp.flashhub.net:8443. This is a cryptominer supply-chain attack injected via a compromised publisher token into an otherwise legitimate @sudobility package; the package's advertised purpose (TanStack Query API client) has no relationship to any of this behavior.

7. @sudobility/indexer_client (npm)

This account appears to have been compromised by a maliicious threat actor, although we haven't been able to verify this yet as the package author has not responded to our questions about how this happened. Regardless, at least five packages by this author had out of band malicoius versions published to NPM.

The postinstall hook sh scripts/miner.sh executes automatically on every npm install. The IOCs recovered in plaintext confirm the attacker model: a hardcoded Monero wallet address, an AWS access key (AKIAUHL4Y2TJZ7L7AE3F) used to authenticate S3 downloads, and the version itself is deprecated with an explicit note that it was published from a compromised npm token. The miner.sh script fetches a gzip payload from an attacker-controlled S3 bucket and deploys either a persistent agent with cron/tor-channel or the bundled bin/miner-linux-amd64 XMRig binary, configured to connect to the XMRig pool at networkservicesupp.flashhub.net:8443. This is a cryptominer supply-chain attack injected via a compromised publisher token into an otherwise legitimate @sudobility package; the package's advertised purpose (TanStack Query API client) has no relationship to any of this behavior.

8. @sudobility/testomniac_client (npm)

This account appears to have been compromised by a maliicious threat actor, although we haven't been able to verify this yet as the package author has not responded to our questions about how this happened. Regardless, at least five packages by this author had out of band malicoius versions published to NPM.

The postinstall hook sh scripts/miner.sh executes automatically on every npm install. The IOCs recovered in plaintext confirm the attacker model: a hardcoded Monero wallet address, an AWS access key (AKIAUHL4Y2TJZ7L7AE3F) used to authenticate S3 downloads, and the version itself is deprecated with an explicit note that it was published from a compromised npm token. The miner.sh script fetches a gzip payload from an attacker-controlled S3 bucket and deploys either a persistent agent with cron/tor-channel or the bundled bin/miner-linux-amd64 XMRig binary, configured to connect to the XMRig pool at networkservicesupp.flashhub.net:8443. This is a cryptominer supply-chain attack injected via a compromised publisher token into an otherwise legitimate @sudobility package; the package's advertised purpose (TanStack Query API client) has no relationship to any of this behavior.

9. sitecard (pypi)

The package provides code to create an SSH session exposed via tunnels. By default, created session is accessible without any auth and reported to a hardcoded location, exposing any user to be accessed by attacker.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-sitecard

Reasons (based on the campaign):

  • backdoor

10. solivoxtts (pypi)

This campaign consists of similar loader packages, which provide executing code from a given URL. While they do not contain the malicious payload and the usage remains unknown, they are clearly a coordinated campaign to place multiple deceptive ways to load malicious code.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-10-voice-synthesis-profiles

Reasons (based on the campaign):

  • Downloads and executes a remote malicious script.
  • other

Judge assessment: The package's sole purpose is a remote code execution loader: on import it fetches an arbitrary Python source file from a caller-supplied URL and executes it in-process via compile()+exec(), with the example URL hardcoded in the docstring pointing to a remote eval-profile.py. The description 'tiny standard-library-only runner for remote profiles' is cover language for a generic RCE primitive — there is no legitimate TTS functionality whatsoever. The combination of no source repository, brand-new account, single version, and the OSV-confirmed campaign attribution (2026-10-voice-synthesis-profiles) further corroborates coordinated attacker infrastructure. The fetched payload is written to a temp-dir cache and executed, enabling persistence of whatever the server delivers.

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com

Credits for the core data goes to https://opensourcemalware.com