Malicious Code Digest Monthly Recap: February

Welcome to the latest edition of the Xygeni Malicious Code Digest (Monthly Edition). Once again, our security team analyzed real package telemetry across public registries to identify what traditional scanners often overlook: malicious code designed to blend into trusted developer workflows.

Over the past few weeks, we confirmed more than 230 malicious packages, primarily across npm, with occasional PyPI cases. However, this month was not only about volume.

Our research team conducted two in-depth investigations into high-impact threats:

• A newly uncovered npm-based infostealer campaign capable of credential theft and session hijacking in developer environments.

• A malicious fork targeting the Baileys WhatsApp library supply chain, abusing trust in a popular ecosystem component to infiltrate dependency trees.

These were not simple typosquatting attempts. Both cases involved credential abuse techniques and supply chain manipulation designed to impact real CI/CD pipelines and production environments.

Beyond these investigations, recent waves continued to show automation-driven publishing, aggressive version inflation, and internal-tool impersonation patterns, alongside classic tactics such as typosquatting, dependency confusion, and data exfiltration. The objective remains consistent: bypass trust heuristics and quietly compromise developer systems before detection.

This monthly update is part of our ongoing malware report, where we publish validated findings, confirm emerging threats, and provide actionable intelligence to help DevSecOps teams stay ahead of supply chain risk.

For full context across every malicious package analyzed this month, explore the complete Malicious Code Digest.