Monatliche Zusammenfassung des Malicious Code Digest: September

Welcome to the September edition of the Xygeni Malicious Code Digest. This month, our security research team confirmed 104 malicious packages across npm and PyPI, tracked across four weekly digests.

September was defined by three converging trends: campaigns that carried straight over from August and kept going despite takedowns; dependency confusion at scale, with dozens of packages claiming inflated version numbers like 99.0.0 und 19999.x to hijack private namespaces; and a clear move toward the plugin and automation ecosystems developers trust with privileged access, such as Strapi, n8n and MCP.

Zu den bemerkenswertesten Kampagnen, die in diesem Monat dokumentiert wurden:

• Das self-deleting anti-proctoring operator returned on September 1, with amicat, bmcat, eyevox und moidevh confirmed alongside two new names from the same stem, moidevk und moidevl.
• Baileys, the WhatsApp Web API library impersonated throughout August, stayed under attack: cloud-baileys reached versions 1.1.37 und 1.1.38 in the first week and 1.1.41 by September 19, making it one of the longest-running impersonations we have tracked.
• A 21-package campaign (September 15 to 17) published fake Strapi plugins under the “meeb” tag, all at the identical version 3.6.8, alongside companion packages with names like os-info-meeb322k und fs-pwn-meeb322k.
• A single package, @nimbusedge/auth, shipped 39 versions in one day (September 11), all numbered 19999.x so they would outrank any legitimate internal version.
• Dependency-confusion packages bearing corporate and internal-sounding names appeared every week: etoro-cashout, etoro-analytics und etoro-aggregator (September 11), concierge-sdk at 99.99.99 (September 13), @traktis/core (September 17) und @dbbhk/ui-components, @siriusbeyond/* und @alphaspace/core at 99.x in the last week of the month.
• The “siriusbeyond” operator started with a single unscoped package on September 20 and came back four days later as a scoped family (@siriusbeyond/auth, /ui, /utils), the same brand dressed as an internal package set.
• Fake n8n workflow nodes recurred through the month, including n8n-nodes-sysdiag2, n8n-nodes-buildcheck und n8n-nodes-data-transformer-utils, continuing a pattern first seen in August.
• An MCP client, mcp-consultasdeveiculos-client, was published in three versions on a single day (September 4), a reminder that the AI tooling layer is now part of the same supply chain.
• Six numbered copies of simple-date-formatter-new-* (11 to 16) were published on September 25, a scripted burst built to test which names get through.

The defining pattern of September: attackers are no longer only borrowing trusted names, they are borrowing trusted positions. Plugins, workflow nodes, MCP clients and private package namespaces all run with more access than a typical dependency, and they are exactly where September’s campaigns concentrated.

Nachfolgend finden Sie eine Zusammenfassung unserer Ergebnisse. Die vollständigen Daten der vier Wochen können Sie unter folgendem Link einsehen: Index für bösartigen Code.