Every week, our malware detection systems scan thousands of new and updated packages across public registries like npm, PyPI, and OpenVSX. We confirmed 206 malicious packages between July 31 and August 7, 2026, led by a wave of malware openly branded after known AI-attack tools, and a dependency-confusion cluster impersonating cryptocurrency wallet libraries.
The most attention-grabbing find: wormgpt-cli on npm, nine versions published in rapid succession on August 7, alongside a companion package, gpt-terminal-cli, published the same day. The name is a direct reference to WormGPT, a real dark-LLM tool marketed to cybercriminals for phishing and malware generation, suggesting the package is trading on the brand recognition of an actual attacker tool rather than hiding behind a neutral name.
A separate cluster targeted cryptocurrency infrastructure directly: nine packages on npm impersonating real wallet and signing libraries (ledger-lib, trezor-lib, bip32-js, ethers-lib, python-bitcoinlib, ckcc-protocol, hwi-lib, mnemonic-utils, ethereum-sign-utils), all confirmed within the same window on August 5, a textbook dependency-confusion play aimed at crypto and Web3 developers pulling in what look like standard signing utilities.
The markscan, akrai, and iphouse lookalike cluster we flagged last week kept growing, with several more versions confirmed July 31 through August 1. That same window also produced a more serious find: the beaver-ui-* and accounts-* cluster confirmed August 1 turned out to be QuietPolyfill, a three-stage dropper disguised as internal UI component and utility packages. The payload triggers on require(), not an install script, so --ignore-scripts does not stop it. Nineteen of the twenty package names were unpublished by the operator within hours of detection; one was republished under a different account the next day, and the delivery infrastructure was still live when we published our full analysis.
This weekly snapshot is part of our ongoing Malicious Code Digest, where we validate new threats and provide actionable intelligence to help DevSecOps teams protect their pipelines before damage occurs.
When Volume Meets Payload: 206 Malicious Packages This Week
This week’s digest shows two attack patterns running in parallel, not just faster publishing, but publishing built to actually execute. wormgpt-cli went from zero to nine versions on npm in a single day, brazenly named after a real dark-LLM tool sold to cybercriminals, the same automated speed no manual review process can match. A separate cluster of nine packages impersonated cryptocurrency wallet and signing libraries (ledger-lib, trezor-lib, bip32-js, and others), all confirmed within hours of each other on August 5, a synchronized drop timed to win a dependency-confusion race before anyone notices.
But the week’s most serious find wasn’t about volume at all. QuietPolyfill, the beaver-ui-* and accounts-* cluster we broke down in full, turned out to be a three-stage dropper that triggers on require(), not an install script, so --ignore-scripts never sees it. Nineteen of the twenty package names were pulled by their own operator within hours, and one came back the next day under a different account, with the delivery infrastructure still live.
Xygeni Early Malware Warning monitors npm, PyPI, OpenVSX, and other registries in real time, flagging threats at the moment of publication, before they reach a build, before an AI agent installs them autonomously, and before a dropper like QuietPolyfill gets the chance to execute on the first import. When a package ships nine versions in a day, or a “UI component library” quietly retrieves and runs a signed loader, detection that runs after the fact is already too late.
Xygeni’s Open Source Security platform gives DevSecOps teams the real-time detection and prioritization needed to stay ahead of coordinated supply chain pressure, so your pipelines stay clean without slowing your teams down.
