--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (f49aaf5b1b6388b52d7afd99359db7630e272770abd123c0cfc9977c0467b78d) In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-kimichat Reasons (based on the campaign): - cryptominer

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (448ec8ad7c978d60f142f12780be3bb6ae7b90870fa4c2bf2d50ca7d4111cdfd) This package is prepared to perform steganography decoding using the same code and was published on the same day as package 'rasterkit,' later used to deliver malicious payload. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-textwrap-toolkit-stager Reasons (based on the campaign): - …

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (e622a7f45c572488da7a3dcea95a8deb6a56b0dfd843cd85483373bd03fb8974) The package hides code to download and execute a remote executable from a newly created fastsyncapi[.]com domain. It is disguised as a remote 'fast color helper,' as opposed to the local helper, also included in the code, that only mimics any functionality. The malicious part is not immediately active: to download the binary, a key is required, which …

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (1620206c32062d89cd35aa65951fb139a004cf78c5d1b0b6eae1e7fb7378238e) The OpenSSF Package Analysis project identified 'signzy-field-level-encrypter' @ 12.9.13 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (a6eea31746baa37e55a76fec564eda1852839be005d53ae1e24bf2b9ea4c7875) This package is a clone of Pillow library with malicious code hidden in an image using steganography. The code is the used in a dependant package to install an SSH backdoor. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-textwrap-toolkit-stager Reasons (based on the campaign): - back…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (29eb6057bbc11a0f0180a030db952f9ec8aa39ce8c4b0d437046b20301f5b21a) During import, the code uses steganography to extract code from an image hidden in the dependency. The code then adds a new authorized SSH key and reports back the IP of the current environment. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-06-textwrap-toolkit-stager Reasons (based on the…

--- _-= Per source details. Do not edit below this line.=-_ ## Source: kam193 (ed721bd4c1baf8e69a7f3c5039ac5644b8c6f0795e87fc711d3cd2b0a523c1e1) In this campaign, packages use names similar to popular services (e.g. Kimi AI) to deploy cryptominer. --- Category: MALICIOUS - The campaign has clearly malicious intent, like infostealers. Campaign: 2026-07-kimichat Reasons (based on the campaign): - cryptominer

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (186ad60c2221871a68cd4513fc2d2295a0595156cdea7615a49de03572f2e8e8) The OpenSSF Package Analysis project identified 'commonweb-rewards' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (3b11cf69cfe3f87442591bf436e6905273bc84de3171c27102b63406c0fe3235) The OpenSSF Package Analysis project identified 'consumerweb-calurls' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

--- _-= Per source details. Do not edit below this line.=-_ ## Source: ossf-package-analysis (0f81c6e2e081a09ccd8ad4ade2f34c142e2f0db5566c881ca78acaff3e4de84a) The OpenSSF Package Analysis project identified 'commonweb-card' @ 99.9.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.