Resumo mensal do Malicious Code Digest: setembro

Welcome to the September edition of the Xygeni Malicious Code Digest. This month, our security research team confirmed 104 malicious packages across npm and PyPI, tracked across four weekly digests.

September was defined by three converging trends: campaigns that carried straight over from August and kept going despite takedowns; dependency confusion at scale, with dozens of packages claiming inflated version numbers like 99.0.0 e 19999.x to hijack private namespaces; and a clear move toward the plugin and automation ecosystems developers trust with privileged access, such as Strapi, n8n and MCP.

Entre as campanhas mais notáveis ​​documentadas neste mês:

• O self-deleting anti-proctoring operator returned on September 1, with amicat, bmcat, eyevox e moidevh confirmed alongside two new names from the same stem, moidevk e moidevl.
• Baileys, the WhatsApp Web API library impersonated throughout August, stayed under attack: cloud-baileys reached versions 1.1.37 e 1.1.38 in the first week and 1.1.41 by September 19, making it one of the longest-running impersonations we have tracked.
• A 21-package campaign (September 15 to 17) published fake Strapi plugins under the “meeb” tag, all at the identical version 3.6.8, alongside companion packages with names like os-info-meeb322k e fs-pwn-meeb322k.
• A single package, @nimbusedge/auth, shipped 39 versions in one day (September 11), all numbered 19999.x so they would outrank any legitimate internal version.
• Dependency-confusion packages bearing corporate and internal-sounding names appeared every week: etoro-cashout, etoro-analytics e etoro-aggregator (Setembro 11), concierge-sdk at 99.99.99 (Setembro 13), @traktis/core (Setembro de 17), e @dbbhk/ui-components, @siriusbeyond/* e @alphaspace/core at 99.x in the last week of the month.
• The “siriusbeyond” operator started with a single unscoped package on September 20 and came back four days later as a scoped family (@siriusbeyond/auth, /ui, /utils), the same brand dressed as an internal package set.
• Fake n8n workflow nodes recurred through the month, including n8n-nodes-sysdiag2, n8n-nodes-buildcheck e n8n-nodes-data-transformer-utils, continuing a pattern first seen in August.
• An MCP client, mcp-consultasdeveiculos-client, was published in three versions on a single day (September 4), a reminder that the AI tooling layer is now part of the same supply chain.
• Six numbered copies of simple-date-formatter-new-* (11 to 16) were published on September 25, a scripted burst built to test which names get through.

The defining pattern of September: attackers are no longer only borrowing trusted names, they are borrowing trusted positions. Plugins, workflow nodes, MCP clients and private package namespaces all run with more access than a typical dependency, and they are exactly where September’s campaigns concentrated.

Abaixo, segue um resumo das nossas descobertas. Você pode consultar os dados completos das quatro semanas em detalhes no site. Índice do Malicious Code Digest.