Malicious Code Digest Monthly Recap: September

Welcome to the September edition of the Xygeni Malicious Code Digest. This month, our security research team confirmed 104 malicious packages across npm and PyPI, tracked across four weekly digests.

September was defined by three converging trends: campaigns that carried straight over from August and kept going despite takedowns; dependency confusion at scale, with dozens of packages claiming inflated version numbers like 99.0.0 and 19999.x to hijack private namespaces; and a clear move toward the plugin and automation ecosystems developers trust with privileged access, such as Strapi, n8n and MCP.

Among the most notable campaigns documented this month:

• The self-deleting anti-proctoring operator returned on September 1, with amicat, bmcat, eyevox and moidevh confirmed alongside two new names from the same stem, moidevk and moidevl.
• Baileys, the WhatsApp Web API library impersonated throughout August, stayed under attack: cloud-baileys reached versions 1.1.37 and 1.1.38 in the first week and 1.1.41 by September 19, making it one of the longest-running impersonations we have tracked.
• A 21-package campaign (September 15 to 17) published fake Strapi plugins under the “meeb” tag, all at the identical version 3.6.8, alongside companion packages with names like os-info-meeb322k and fs-pwn-meeb322k.
• A single package, @nimbusedge/auth, shipped 39 versions in one day (September 11), all numbered 19999.x so they would outrank any legitimate internal version.
• Dependency-confusion packages bearing corporate and internal-sounding names appeared every week: etoro-cashout, etoro-analytics and etoro-aggregator (September 11), concierge-sdk at 99.99.99 (September 13), @traktis/core (September 17), and @dbbhk/ui-components, @siriusbeyond/* and @alphaspace/core at 99.x in the last week of the month.
• The “siriusbeyond” operator started with a single unscoped package on September 20 and came back four days later as a scoped family (@siriusbeyond/auth, /ui, /utils), the same brand dressed as an internal package set.
• Fake n8n workflow nodes recurred through the month, including n8n-nodes-sysdiag2, n8n-nodes-buildcheck and n8n-nodes-data-transformer-utils, continuing a pattern first seen in August.
• An MCP client, mcp-consultasdeveiculos-client, was published in three versions on a single day (September 4), a reminder that the AI tooling layer is now part of the same supply chain.
• Six numbered copies of simple-date-formatter-new-* (11 to 16) were published on September 25, a scripted burst built to test which names get through.

The defining pattern of September: attackers are no longer only borrowing trusted names, they are borrowing trusted positions. Plugins, workflow nodes, MCP clients and private package namespaces all run with more access than a typical dependency, and they are exactly where September’s campaigns concentrated.

Below is a summary of what we found. You can see all four weeks’ data disclosed in full detail at the Malicious Code Digest index.