Skip to content

MALICIOUS (1) campaign cataloged at 2026-10-31(2).

  1. The campaign has clearly malicious intent, like infostealers.
  2. This is just the date of creating the catalog entry. It may not reflect the date of creation of the campaign itself.

2026-10-is-it-ai

In this campaign, specific versions of involved affected packages hide malicious actions. The malicious code is hidden in specific versions of a dependency (is-it-ai), intentionally pinned by specific versions of dependent packages. All package versions were uploaded with malicious intention; the ones without malicious references are clearly intendent only to hide a cover for the rest. When triggered, the malicious action fingerprints the environment and contacts the remote server. If it responds with an URL, it will be downloaded and executed.

Abuse categories

action-hidden-in-lib-usage

The malicious action is hidden in the code and starts when user interacts with it (e.g. during class initialization or by exfiltrating given credentials).

remote_executable

Downloads and executes a remote executable.

targetted-attack

Campaign uses targetted-attack.

through_dependency

The malicious code is intentionally included in a dependency of the package

URLs with payloads, characteristic domains, C&C IPs, repositories with malicious code, etc.

  • cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app

  • hxxps://cdn-9zp0pi12ck0dmfig-3ozmpyh7ja-uc.a.run.app/v1/session/info

Packages in the campaign

campaign:2026-10-is-it-ai