Welcome to the latest edition of the Xygeni Malicious Code Digest (Monthly Edition). Once again, our security teams have been diving deep into real package data to spot what traditional tools often miss. The goal? Catch and block malicious packages before they land in your codebase or pipeline.
Over the past few weeks, we’ve confirmed over 280 malicious packages spreading across npm and PyPI. Many used advanced tactics like typosquatting, dependency confusion, and data exfiltration, all designed to slip past automated checks and compromise your environment.
This monthly update is part of our ongoing malware report, where we publish weekly findings, confirm new threats, and help DevSecOps teams stay ahead. If you want full context across every malicious package we’ve analyzed, make sure to explore the complete malicous code digest here.
Important note:
this list does not include the packages affected by the second wave of the Shai Hulud npm supply chain attack. You can find the full breakdown of that campaign, along with all impacted packages, in our dedicated analysis:
Week 4: Over 16 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | secguest-lib:1.0.0 | Dec 19, 2025 |
| npm | ppppparserfruit:0.30.1 | Dec 19, 2025 |
| npm | viktorparserctf5:1.0.0 | Dec 19, 2025 |
| npm | viktorparserctf7:1.0.0 | Dec 19, 2025 |
| npm | viktorparserctf8:1.0.0 | Dec 19, 2025 |
| npm | @aa-techops-ui/ping-authentication:1.0.6 | Dec 23, 2025 |
| npm | @aa-techops-ui/ping-authentication:3.99.99 | Dec 23, 2025 |
| npm | @aa-techops-ui/ping-authentication:2.99.99 | Dec 23, 2025 |
| npm | @aa-techops-ui/ping-authentication:4.99.99 | Dec 23, 2025 |
| npm | @aa-techops-ui/ping-authentication:5.99.99 | Dec 23, 2025 |
| npm | xbox-bottomnav:99.9.9 | Dec 19, 2025 |
| npm | sarumaan_a:1.1.2 | Dec 19, 2025 |
| npm | @ikarem/telemetry:100.1.0 | Dec 19, 2025 |
| npm | @ikarem/telemetry:100.1.1 | Dec 19, 2025 |
| npm | shaktihacker2026:99.9.0 | Dec 22, 2025 |
| npm | utif-updated:99.0.0 | Dec 23, 2025 |
Week 3: Over 33 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | wfui-dsm-react-ui:99.99.1 | Dec 15, 2025 |
| npm | let1xx:8.0.0 | Dec 16, 2025 |
| npm | let1xz:8.0.1 | Dec 16, 2025 |
| npm | let1x:8.0.1 | Dec 16, 2025 |
| npm | let1x1:8.0.3 | Dec 16, 2025 |
| npm | let1x6:8.0.0 | Dec 16, 2025 |
| npm | let1x7:8.0.0 | Dec 16, 2025 |
| npm | private-internal-sdk:1.0.0 | Dec 16, 2025 |
| npm | private-internal-sdk:1.0.1 | Dec 16, 2025 |
| npm | @ikarem/telemetry:100.0.6 | Dec 16, 2025 |
Week 2: Over 92 Packages Discovered
| Ecosystem | Package | Version | Confirmation Date |
|---|---|---|---|
| npm | ppppparserfruit | 0.30.1 | Dec 12, 2025 |
| npm | cdd-plugin-for-datawarrior | 8.0.0 | Dec 12, 2025 |
| npm | serval-integrations-common-frontend | 7.0.0 | Dec 10, 2025 |
| npm | @onlytoodles/crypto-jsa | 1.0.0 | Dec 10, 2025 |
| npm | paypal-scripts-server-utils | 9.0.0 | Dec 12, 2025 |
| npm | phx-core | 9.0.0 | Dec 12, 2025 |
| npm | @vampirchik147/xml | 1.0.0 | Dec 12, 2025 |
| npm | vue2-amis-custom-widget123 | 1.0.10 | Dec 12, 2025 |
| pypi | kzip | 0.1.0 | Dec 12, 2025 |
| npm | asdfgh3 | 0.30.6 | Dec 12, 2025 |
Week 1: Over 63 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | ccs-react-lib:7.7.8 | Nov 5, 2025 |
| npm | react-tmedia:2.1.4 | Nov 6, 2025 |
| npm | react-ui-animates:1.7.6 | Nov 3, 2025 |
| npm | react-tchart:1.4.5 | Nov 3, 2025 |
| npm | faustjs-org-sitemm2:1.0.0 | Nov 7, 2025 |
| npm | geopost-web-component:16.8.0 | Nov 3, 2025 |
| npm | express-document-sdk:99.0.0 | Nov 3, 2025 |
| npm | int_affirm_controllers:99.0.0 | Nov 3, 2025 |
| npm | frontend-buenaspracticas:100.9.9 | Nov 3, 2025 |
| npm | ctflibxmljs2:0.30.1 | Nov 3, 2025 |
Secure Your Open Source Dependencies against Vulnerabilities and Malicious Code
Malware isn’t just a theoretical risk anymore, it’s already hiding in public packages. With Xygeni’s Early Malware Detection, you can reduce exposure by catching threats as soon as they’re published, before they reach your pipeline.
Our real-time scanning and prioritization engine continuously monitors public registries like npm and PyPI. Malicious packages are blocked, flagged, and ranked based on impact, so you know exactly what needs fixing, and when. Whether it’s typosquatting, dependency confusion, or credential stealers, we help your team stay ahead.
If you want full visibility into weekly and monthly findings, check the complete Malicious Code Digest.
Stay secure. Stay fast. Stay in control with Xygeni.
