Xygeni Malicious Code Digest 73

Almost every week, our malware detection systems scan thousands of new and updated packages across public registries like npm and PyPI. This week was very active.

We confirmed 198 ka malisyosong mga pakete, primarily across npm, with additional cases in PyPI, OpenVSX, Composer, and VS Code extensions. Several appeared in coordinated clusters, with repeated malicious releases published under the same names or across closely related package families. A standout case was the sensivity package, which flooded npm with over 60 versioned releases across the 2.5.x range. Other notable clusters included ai-sdk-helpers (8 versions targeting AI developers), @antoncallahan/aws-user-helper (7 versions impersonating an AWS utility), @apple-pay-trust ug @google-pay-trust families (mimicking payment checkout modules), @frengki0707/google-cloud-clone (5 versions spoofing Google Cloud), and cms-storehub, cms-helpgit, Ug cms-github (targeting CMS pipelines). Many packages mimicked payment and checkout modules, enterprise and internal web packages, analytics clients, UI foundations, developer utilities, component explorers, cloud- and Google-themed packages, and other modules commonly trusted in modern development workflows.

These were not isolated anomalies. What stood out this week was the scale of repeated publishing across the same package families, the reuse of naming patterns, and the way malicious packages were disguised to look like legitimate dependencies inside real software delivery pipelines.

This weekly snapshot is part of our ongoing Malicious Code Digest, where we validate new threats and provide actionable intelligence to help DevSecOps teams protect their pipelines before damage occurs.

Atong hisgutan unsay atong nakit-an karong semanaha ug nganong importante kini.