Welcome to the latest edition of the Xygeni Malicious Code Digest (Monthly Edition). Once again, our security teams have been diving deep into real package data to spot what traditional tools often miss. The goal? Catch and block malicious packages before they land in your codebase or pipeline.
Over the past few weeks, we’ve confirmed more than 180 malicious packages across npm (and occasional PyPI cases). Recent waves show heavy use of automation-driven publishing, version inflation, and internal-tool impersonation, alongside classic tactics like typosquatting, dependency confusion, and data exfiltration, all designed to slip past automated checks and quietly compromise developer environments and CI/CD pipelines.
This monthly update is part of our ongoing malware report, where we publish weekly findings, confirm new threats, and help DevSecOps teams stay ahead. If you want full context across every malicious package we’ve analyzed, make sure to explore the complete malicous code digest here.
Week 4: Over 70 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | @acqui-calm-library/acqui-hero-carousel-section:999.99.999 | Jan 23, 2026 |
| npm | com.unity.xr.visionos:2.3.2 | Jan 27, 2026 |
| npm | vvvv4234:1.0.1 | Jan 27, 2026 |
| npm | frontend-js-state-web:2.2.3 | Jan 27, 2026 |
| npm | google-audit-tool:1.0.0 | Jan 30, 2026 |
| npm | solhint-plugin-hyperlane:99.9.9 | Jan 27, 2026 |
| npm | @row-components/pricing-embedded-sui:77.7.7 | Jan 27, 2026 |
| npm | un112:1.0.39 | Jan 23, 2026 |
| npm | not-remix:9.0.0 | Jan 28, 2026 |
| npm | translation-note:9.0.0 | Jan 27, 2026 |
Week 3: Over 44 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | react-server-dom-unbundled:9.2.31 | Jan 16, 2026 |
| npm | natateste:1.1.0 | Jan 21, 2026 |
| npm | victim-package-a:1.0.1 | Jan 21, 2026 |
| npm | worldnormal:1.0.0 | Jan 21, 2026 |
| npm | typedoc-plugin-fuel-variants:1.0.1 | Jan 21, 2026 |
| npm | worldposition:1.0.0 | Jan 21, 2026 |
| npm | vworldviewdir:1.0.0 | Jan 21, 2026 |
| npm | forms-new-design:99.99.9 | Jan 21, 2026 |
| npm | dux-portal-privacy:4.9.121 | Jan 16, 2026 |
| npm | presentation-test-utilities:0.0.1 | Jan 21, 2026 |
Week 2: Over 30 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | jz-test-npm:114.8.10 | Jan 12, 2026 |
| npm | internallib_v147:1.0.1 | Jan 12, 2026 |
| npm | jz-test-npm:114.8.114 | Jan 12, 2026 |
| npm | forms-new-design:99.99.9 | Jan 12, 2026 |
| npm | s3-cache-handler:0.1.0 | Jan 12, 2026 |
| npm | @icecreampie/internallib_v147:1.0.1 | Jan 12, 2026 |
| npm | presentation-test-utilities:0.0.1 | Jan 12, 2026 |
| npm | not-remix:9.0.0 | Jan 12, 2026 |
| npm | lyonscg:88.8.8 | Jan 12, 2026 |
| npm | @gwp-gtmt-components/event-listener:77.7.7 | Jan 12, 2026 |
Week 1: Over 40 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | unescaped:1.0.0 | Jan 05, 2026 |
| npm | github-badge-bot:1.8.2 | Jan 02, 2026 |
| pypi | system-health-check-test-unique:0.3.4 | Jan 02, 2026 |
| pypi | pdatainstaller:1.0.0 | Jan 02, 2026 |
| pypi | qdatainstaller:1.0.1 | Jan 05, 2026 |
| npm | 1231dai:1.0.0 | Jan 02, 2026 |
| npm | shopify-perf-kit:8.2.31 | Jan 02, 2026 |
| npm | shopify-perf-kit:8.2.32 | Jan 02, 2026 |
| npm | hello-world-npm-demo-example:1.0.0 | Jan 06, 2026 |
| npm | hello-world-npm-demo-example:1.0.1 | Jan 06, 2026 |
Secure Your Open Source Dependencies against Vulnerabilities and Malicious Code
Malware isn’t just a theoretical risk anymore, it’s already hiding in public packages. With Xygeni’s Early Malware Detection, you can reduce exposure by catching threats as soon as they’re published, before they reach your pipeline.
Our real-time scanning and prioritization engine continuously monitors public registries like npm and PyPI. Malicious packages are blocked, flagged, and ranked based on impact, so you know exactly what needs fixing, and when. Whether it’s typosquatting, dependency confusion, or credential stealers, we help your team stay ahead.
If you want full visibility into weekly and monthly findings, check the complete Malicious Code Digest.
Stay secure. Stay fast. Stay in control with Xygeni.
