This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. tailwindcss-contact-forms (npm)

NullReceiver

The file contains heavily obfuscated code that executes shell commands via 'spawn' with '-e' and communicates with Ethereum RPC endpoints. It specifically targets crypto-related data and environment variables (ETHRPCURL), consistent with the NullReceiver campaign.

2. pylever (pypi)

The package contains a stealer exfiltrating Discord tokens to a hardcoded location.

Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers.

Campaign: 2026-09-pylever

Reasons (based on the campaign):

  • infostealer

3. xbailsync (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

4. @yongot/canary-mcp-test (npm)

Package @yongot/[email protected] ships beacon.js which runs execSync('id'), reads os.hostname(), and issues an HTTPS GET to a hardcoded webhook.site collector (https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b) with stage, host, and id_output query parameters. The package.json postinstall hook invokes node beacon.js postinstall, so the beacon fires automatically on npm install. index.js (the package main) also requires beacon.js twice at load time, so any consumer that imports the package re-triggers the same exfiltration of the installer's Unix uid/gid/groups and hostname to the third-party webhook collector.

5. cat-sis2go-utils (npm)

Package [email protected] declares both preinstall and postinstall lifecycle hooks in package.json that execute scripts/run.js on every npm install. The script unconditionally issues a DNS lookup against d22d92dc-84e5-4b58-8cd6-75bf1ac452c7.dnshook.site and POSTs a JSON beacon containing the installer's hostname and process context to https://webhook.site/d22d92dc-84e5-4b58-8cd6-75bf1ac452c7. The package description self-identifies as a dependency-confusion PoC, and the 99.0.0 version is consistent with a resolution-winning squat targeting an internal package name. Installing the package results in arbitrary code execution on the installer host and fingerprints the machine to third-party out-of-band collectors under the operator's control.

6. saeka (pypi)

Malicious package detected. Behaviors: data exfiltration, code execution.

7. @yongot/canary-mcp-isolation (npm)

The package's postinstall script (beacon.js), also re-executed on require via index.js, sends the installer's hostname, run identifiers, and the output of the id shell command to a hardcoded third-party collector at https://webhook.site/b76376f8-118e-44f1-a5ee-8a73f55b137b over HTTPS. The same script probes the GCP instance metadata service at 169.254.169.254 and metadata.google.internal with the Metadata-Flavor: Google header and reports the status and body back to the webhook, disclosing whether the install environment is a cloud VM and what IMDS returns. Data leaves the installer's host to an attacker-controlled collector automatically on npm install and on require(), without consent.

8. gmgn-trading-kit (npm)

postinstall.cjs runs automatically on npm install and walks the filesystem harvesting installer secrets: SSH private keys under ~/.ssh, ~/.netrc, ~/.git-credentials, Solana keypairs, wallet.json/key.* files under ~/.config, and ~/.blockrun wallet files. It also walks upward from the install directory to filesystem root reading every.env it finds, filtering for KEY/SECRET/PRIVATE/TOKEN substrings. Each file's full contents is POSTed via https.request to a hardcoded webhook.site collector at https://webhook.site/d7ab73fe-7cbc-4ed3-bf8e-7207eb06875b. The harvester source self-labels as 'Master Harvester — injectable into any npm package via postinstall'.

9. soltinel-pro (npm)

postinstall.cjs is declared as the package.json postinstall script and runs automatically on npm install. The script walks parent directories for.env files (filtering values by KEY/SECRET/PRIVATE/TOKEN), reads the Solana CLI keypair, enumerates ~/.config for env/key/wallet/credentials files, reads ~/.ssh private keys (idrsa, ided25519, *rsa, *ed25519), ~/.git-credentials, and ~/.netrc, then POSTs the file contents via https.request to a hardcoded webhook.site collector. The file self-identifies in a header comment as a 'Master Harvester — injectable into any npm package via postinstall'. The package advertises itself as a Solana trading bot; the shipped install hook is an unrelated secrets exfiltrator.

10. etoro-aggregator (npm)

[email protected] ships a preinstall.js that runs automatically on npm install and issues an HTTP GET to http://209.126.81.147/etoro-depconf-poce346552f776f/npm///, encoding os.hostname(), os.userInfo().username, and process.cwd() as URL path segments. The version number (999.0.0), generic package name, and absence of any legitimate library code are consistent with a dependency-confusion lure: installing the package causes the installer's host identity to be sent to an attacker-controlled bare-IP endpoint over plaintext HTTP, providing reconnaissance for targeted follow-on attacks against organizations whose internal package names collide with this name.

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com

Credits for the core data goes to https://opensourcemalware.com