Malicious Code Digest Monthly Recap: March

Welcome to the latest edition of the Xygeni Malicious Code Digest (Monthly Edition). Once again, our security team analyzed real package telemetry across public registries to identify what traditional scanners often overlook: malicious code designed to blend into trusted developer workflows.

Over the past few weeks, we confirmed more than 270 malicious packages, primarily across npm, with additional cases affecting PyPI, VS Code, and OpenVSX. However, this month was not only about volume.

Our research team conducted in-depth analysis into high-impact threats, including:

The LiteLLM Supply Chain Attack, where compromised security tooling was used to backdoor AI infrastructure and distribute malicious code through a widely trusted dependency chain:

Recurring malware waves built around fake internal tooling, AI-themed packages, SDK impersonation, frontend components, builder utilities, and repeated version bursts under the same package families.

These were not simple typosquatting attempts. They involved credential abuse, supply chain manipulation, repeated namespace abuse, and malicious publishing patterns designed to impact real CI/CD pipelines and production environments.

Beyond these investigations, recent waves continued to show automation-driven publishing, aggressive version inflation, internal-tool impersonation patterns, and package clustering across related names, alongside classic tactics such as typosquatting, dependency confusion, and data exfiltration. The objective remains consistent: bypass trust heuristics and quietly compromise developer systems before detection.

This monthly update is part of our ongoing malware report, where we publish validated findings, confirm emerging threats, and provide actionable intelligence to help DevSecOps teams stay ahead of supply chain risk.

For full context across every malicious package analyzed this month, explore the complete Malicious Code Digest.