Welcome to the latest edition of the Xygeni Malicious Code Digest (Monthly Edition). Once again, our security teams have been diving deep into real package data to spot what traditional tools often miss. The goal? Catch and block malicious packages before they land in your codebase or pipeline.
Over the past few weeks, we’ve confirmed over 260 malicious packages spreading across npm and PyPI. Many used advanced tactics like typosquatting, dependency confusion, and data exfiltration, all designed to slip past automated checks and compromise your environment.
This monthly update is part of our ongoing malware report, where we publish weekly findings, confirm new threats, and help DevSecOps teams stay ahead. If you want full context across every malicious package we’ve analyzed, make sure to explore the complete malicous code digest here.
Important note:
this list does not include the packages affected by the second wave of the Shai Hulud npm supply chain attack. You can find the full breakdown of that campaign, along with all impacted packages, in our dedicated analysis:
Week 4: Over 83 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | @rajank18/smart-commit:1.0.0 | Nov 24, 2025 |
| npm | eslint-plugin-whatever:9.0.1 | Nov 23, 2025 |
| npm | ccs-react-lib:7.7.8 | Nov 23, 2025 |
| npm | humhub:5.0.3 | Nov 23, 2025 |
| npm | humhub:5.0.6 | Nov 23, 2025 |
| npm | across-toolkit:9.0.1 | Nov 23, 2025 |
| npm | flaresdsdsdsdsd:45.0.0 | Nov 23, 2025 |
| npm | @secretcollect/identity-core:6.0.0 | Nov 23, 2025 |
| npm | startupkit-umbraco-webpack:2.0.0 | Nov 23, 2025 |
| npm | telstraprogrammablenetworkapilib:2.9.1 | Nov 23, 2025 |
Week 3: Over 49 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | study-lab-npm-test:1.0.0 | Nov 07, 2025 |
| npm | study-lab-e53:1.0.0 | Nov 07, 2025 |
| npm | @acitons/artifact:4.0.13 | Nov 12, 2025 |
| npm | supermoy1:0.30.1 | Nov 11, 2025 |
| npm | supervot5:0.30.1 | Nov 11, 2025 |
| npm | finalmoyloyt:0.30.1 | Nov 11, 2025 |
| npm | xmljs2bank:0.30.2 | Nov 11, 2025 |
| npm | beijingcrisis:3.0.1 | Nov 11, 2025 |
| npm | superbankbackdoor:1.0.0 | Nov 11, 2025 |
| npm | superbankbackdoor:0.30.1 | Nov 11, 2025 |
Week 2: Over 62 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | stack-ui-elements:1.0.0 | Oct 6, 2025 |
| npm | kn-nf-iso-properties-kn1:99.87.31 | Oct 6, 2025 |
| npm | eslint-plugin-paysafe:6.2.6 | Oct 7, 2025 |
| npm | winston-logger-pro:1.1.1 | Oct 7, 2025 |
| npm | merchantauxiliaryserv:1.0.0 | Oct 7, 2025 |
| npm | winston-logger-pro:1.1.0 | Oct 7, 2025 |
| npm | gestion-usuarios:2.0.0 | Oct 7, 2025 |
| npm | incommincentives:2.2.0 | Oct 7, 2025 |
| npm | incommincentives:2.2.1 | Oct 7, 2025 |
| npm | oxrvxaslllcaj:1.0.0 | Oct 7, 2025 |
Week 1: Over 63 Packages Discovered
| Ecosystem | Package | Date |
|---|---|---|
| npm | ccs-react-lib:7.7.8 | Nov 5, 2025 |
| npm | react-tmedia:2.1.4 | Nov 6, 2025 |
| npm | react-ui-animates:1.7.6 | Nov 3, 2025 |
| npm | react-tchart:1.4.5 | Nov 3, 2025 |
| npm | faustjs-org-sitemm2:1.0.0 | Nov 7, 2025 |
| npm | geopost-web-component:16.8.0 | Nov 3, 2025 |
| npm | express-document-sdk:99.0.0 | Nov 3, 2025 |
| npm | int_affirm_controllers:99.0.0 | Nov 3, 2025 |
| npm | frontend-buenaspracticas:100.9.9 | Nov 3, 2025 |
| npm | ctflibxmljs2:0.30.1 | Nov 3, 2025 |
Secure Your Open Source Dependencies against Vulnerabilities and Malicious Code
Malware isn’t just a theoretical risk anymore, it’s already hiding in public packages. With Xygeni’s Early Malware Detection, you can reduce exposure by catching threats as soon as they’re published, before they reach your pipeline.
Our real-time scanning and prioritization engine continuously monitors public registries like npm and PyPI. Malicious packages are blocked, flagged, and ranked based on impact, so you know exactly what needs fixing, and when. Whether it’s typosquatting, dependency confusion, or credential stealers, we help your team stay ahead.
If you want full visibility into weekly and monthly findings, check the complete Malicious Code Digest.
Stay secure. Stay fast. Stay in control with Xygeni.
