The human-verified OpenSourceMalware archive logged 38 records first seen on 1 November, including a run of critical-rated npm packages impersonating cryptocurrency wallet tooling — wallet-adapter-base, sol-wallet-adapter and axelarjs-sdk among them — alongside a PyPI package (doctreelstm) and a scoped cluster of @goparrot-dashboard packages. Each is a confirmed-malicious asset under the archive's four-stage review, so the packages themselves are verified; the affected version must still be checked against a dependency graph before being treated as an incident. The crypto-wallet filenames align with the typosquat and wallet-drainer pattern seen across the marketplace attacks of recent weeks, and the cluster underscores that npm remains a primary delivery surface for campaigns targeting developer and AI-coding workflows. The archive holds these as verified assets; no third-party press corroboration of the specific package set exists in the window.

• Source article