Skip to content

cyrokai Security Research

Field notes from the supply chain.

Deep dives on malicious packages, obfuscation, and the threats our AI analyst catches before they reach main.

Delayed-Activation Crypto Clipper Found in npm Package base58-core

Malware Analysis

Delayed-Activation Crypto Clipper Found in npm Package base58-core

The npm package base58-core@1.0.5 masquerades as a Base58 utility but contains a delayed-activation crypto-clipper that steals cryptocurrency data, swaps wallet addresses, and establishes persistence.

28 Jun 20264 min read

Malware Analysis: nolimit-agent, a Browser-in-the-Browser Phishing Toolkit

Malware Analysis

Malware Analysis: nolimit-agent, a Browser-in-the-Browser Phishing Toolkit

The npm package nolimit-agent is a commercial malware toolkit that uses a malicious Chrome extension to carry out sophisticated Browser-in-the-Browser (BITB) phishing attacks, alongside features for large-scale spam and credential theft.

28 Jun 20264 min read

npm Package claude-team-tracker Steals Claude API Keys and PII

Malware Analysis

npm Package claude-team-tracker Steals Claude API Keys and PII

The npm package claude-team-tracker masquerades as a developer utility but is a targeted info-stealer that steals Anthropic Claude credentials, exfiltrates PII, and establishes persistence.

28 Jun 20263 min read

NPM Trojan 'analysis-chart' Drops DLL, Establishes Persistence, Then Covers Its Tracks

Malware Analysis

NPM Trojan 'analysis-chart' Drops DLL, Establishes Persistence, Then Covers Its Tracks

The npm package analysis-chart masquerades as a data visualization tool but contains a malicious install script that downloads and executes a malicious DLL, establishes persistence, and then attempts to erase its own tracks.

28 Jun 20264 min read

'zomato' npm dependency-confusion campaign

Threat Advisory

'zomato' npm dependency-confusion campaign

cyrokai flagged a same-day cluster of malicious zomato-* packages. Each is a dependency-confusion attack whose preinstall hook exfiltrates your host info and entire environment to an out-of-band server. Do not install them.

21 Jun 20261 min read

'atlasora' npm info-stealer campaign

Threat Advisory

'atlasora' npm info-stealer campaign

cyrokai flagged a same-day cluster of malicious npm packages under the atlasora- prefix. All masquerade as a legitimate SDK and ship the same info-stealing install hook. Do not install them.

20 Jun 20261 min read

A Scanner That Scans You: Inside the npm @intentsolution/database-security-scanner Downloader

Malware Analysis

A Scanner That Scans You: Inside the npm @intentsolution/database-security-scanner Downloader

A package published to npm under a trustworthy security name is an obfuscated dropper. We analyzed every layer with our research engine, from a custom-alphabet base64 decoder to a scrambled C2 address and a payload daemonized into ~/.vscode.

15 Jun 20265 min read

AI-powered supply-chain security.

Blog Contact Platform login

© 2026 cyrokai. All rights reserved.Privacy Terms