This weekly list covers the ten most significant malicious or compromised packages recently observed in public registries.

1. @anthropic-ai/claude-code (npm)

The author of the Claude Code official VS Code extension was compromised and threat actors have published a single malicious version 2.1.313 to the Open-VSX.org registry. We also see that an NPM package for version 2.1.313 was published by the threat actor, but does not appear to have been published to the public registry. We believe it was stopped in NPM staging which is a relatively new function. However, we have not been able to verify that.

We are publishing this threat report in case there was a short window where victims could download version 2.1.313 of this package.

2. @ppa-web-components/ppa-headerfooter (npm)

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution.

3. @ppa-web-components/ppa-searchform (npm)

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution.

4. @ppa-web-components/ppa-navigation (npm)

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution.

5. @ppa-web-components/ppa-builder (npm)

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution.

6. @webapp-shared/login-vmok (npm)

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution.

7. @ppa-web-components/ppa-hotel-collection (npm)

Malicious package detected. Behaviors: data exfiltration, network activity, install-time execution.

8. @drone-js-ext/vip-badge (npm)

The package is a zero-functionality stub whose main module (index.js) exports a Proxy returning no-op functions for any property access. Its only real behavior is a beacon implemented in beacon.cjs that collects installer host identifiers (os.hostname(), __dirname, process.cwd(), process.version, and related os/process fields) and POSTs them over plain HTTP to the hardcoded bare-IP endpoint http://185.158.107.175:8787/_ah/dc. The beacon fires both from the postinstall lifecycle script (triggered automatically by npm install) and at require() time of the main entry. The destination is not a publisher-owned domain, is not configurable, and is not disclosed. The scoped name, implausibly high version (99.0.1), stub implementation, and install-time recon beacon are consistent with a dependency-confusion or typosquat probe harvesting internal installs.

9. @jasperquinn/postcss-motion-helpers (npm)

Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

10. @capsense/core-ui (npm)

Bug bounty dependency confusion attempt. Package exfiltrates basic system information (hostname, IP, DNS) to security research infrastructure. Behaviors: data exfiltration, install-time execution.

Want help mitigating malicious packages before they reach your network?

ShieldedStack acts as a security proxy in front of npm, PyPI, NuGet, and Maven, helping teams detect and block malicious or risky packages before they reach developer machines or CI pipelines.

Learn more: https://shieldedstack.com

Credits for the core data goes to https://opensourcemalware.com