Four newly verified malicious packages — two on npm and two on PyPI — execute their payload during installation, continuing the ecosystem's drift toward the install hook as the primary delivery point. cma-self-hosted-sandbox-cf (npm, critical) declares a preinstall hook that runs an index.js collecting the host name, current-user details, home directory, configured DNS servers and the contents of /etc/passwd and /etc/hosts, then POSTs the JSON result to a hardcoded Burp Collaborator subdomain; the package has no other function, making it a pure reconnaissance and dependency-confusion harvester whose value is the environmental fingerprint, not the loot. agency-test-exercise (npm, high) declares a postinstall hook invoking wscript.exe 4444.vbs, shipping a roughly 660-entry base64 array that is reassembled and decrypted through layered AES-256-CBC and ChaCha20-IETF with SHA-256-derived keys, written to %TEMP% as a random .dat file and handed to powershell.exe as a two-tier loader for in-memory execution and process hollowing; its Windows API targets and cryptographic constants are XOR-masked, and it carries a "Device Telemetry Aggregator / Verdant Signals Corp" cover story while leaving its own author and description fields empty. On PyPI, donutautosellsrc (high) fetches its payload steganographically hidden inside an image at install time and retrieves its command-and-control address from Polygon blockchain transaction history; requests-cache-utils (high) overrides the setup.py install command and also fires on import, downloading and executing an infostealer aimed at browser data. The blockchain-hosted C2 is the significant evolution in this set: storing the address in transaction history removes the domain-takedown path that has historically been the cheapest and most effective disruption tactic against campaigns of this class.

• Source article