As every week, our malware detection systems scan thousands of new and updated packages across public registries. We confirmed 35 malicious package versions between October 4 and 9, 2026 — 31 on npm, 3 on PyPI and 1 on Composer — led by ten packages published within three minutes of one another, two scoped namespaces inflated across four versions apiece, and the Baileys impersonation campaign still going.
Ten in Three Minutes
On October 4, between 01:00 and 01:03, ten npm packages were confirmed back to back, every one pinned to 100.0.0: ai-workshop-radio-app, ai-workshop-radio-lambda, ai-workshop-maa15-radio, apl-rive-renderer, brioche-apl-dev-env, figma-to-apl, alexa-cybertron-team-code-review-agent, live-detection-dashboard, okra-cloud-cdk and niksinnkatalapp — with eslint-plugin-skywagon-web reaching the same 100.0.0 earlier that morning. The names are the tell: internal-sounding tooling that has no reason to exist on public npm. Pinning them to 100.0.0 isn’t an attempt to look legitimate. It’s an attempt to sit above whatever version an internal package resolves to, so a misconfigured build reaches for the attacker’s copy first.
Scoped Names, Inflated Versions
Two scoped namespaces took the same idea with more patience. @inpeek/odata and @inpeek/odata-angular were each pushed across 99.99.99, 99.99.100, 99.99.101 and 99.99.102 on October 5 — eight versions covering the pair. On October 9, @galicia-toolkit/tag-manager and @galicia-toolkit/spa-build-config arrived at 999.0.5 and 999.0.6. Scoped names that read like a company’s private toolkit, pinned to versions no real release ever reaches, are dependency confusion aimed at a resolver rather than at a developer.
Typosquats, PoCs and a Returning Campaign
The rest of the week filled in the familiar edges. cloud-baileys shipped 1.1.42, the latest beat of the Baileys impersonation campaign we’ve tracked since August — last digest it was 1.1.41. @tunstock/remact-dom is a near-miss on react-dom, the kind of one-letter typosquat that only has to survive a tired glance at a lockfile. @rutxploit-sec/waves-button-poc shipped three sequential “PoC” versions, voxeval was confirmed across three PyPI point releases, and slimfit/formbase was the week’s lone Composer entry.
This weekly snapshot is part of our ongoing Malicious Code Digest, where we validate new threats to help DevSecOps teams protect their pipelines before damage occurs.
The Full List: 35 Confirmed Malicious Package Versions
What This Week Tells Us
The shape of this week is speed and disguise. Ten packages at 100.0.0 inside a three-minute window isn’t ten decisions; it’s one script. The payload matters less than the placement: a name that looks like it belongs in your private registry, carrying a version number high enough to win a resolution race. Several of those names lean on the current wave of AI and agent tooling — a code-review agent, an AI-workshop set, a figma-to-APL converter — because that’s where teams are spinning up internal packages fastest, and fast is where confusion lives.
Underneath the burst, the slow campaigns kept their rhythm. Baileys is still publishing, now at cloud-baileys 1.1.42. Scoped namespaces are still being inflated four versions at a time, from @inpeek to @galicia-toolkit. A react-dom look-alike still only needs one careless install. None of these names had a signature when they landed — they were new, which is exactly the window real-time detection exists to close.
Xygeni Malware Early Warning monitors npm, PyPI, Maven, Composer, OpenVSX and other registries in real time, flagging threats at publication — before they reach a build, and before an AI agent installs them autonomously. When ten packages land in three minutes, detection that waits for a signature isn’t late by days; it’s late by the whole attack. Xygeni’s Open Source Security platform adds the prioritization DevSecOps teams need to act on the ones that matter first.
