Tracked campaign · npm

@nolimit-x binary payload

npm packages shipping a Windows PE (SMTP bulk-mailer/credential-checker) as the package main entry, with no source code or documentation.

6,965 packages attributednpm ecosystemosv source

First seen 2025-05-22

Attribution basis

These are the signal classes linking the members of this campaign — the broad evidence categories we use to attribute a package, not the raw indicators themselves.

shared malware fingerprint
OSV advisory cluster

Sample attributed packages

@azure/mcp-template-win32-x64@0.0.12-alpha.6621500
@azure/mcp-template-win32-arm64@0.0.12-alpha.6621500
@azure/mcp-template-win32-arm64@0.0.12-alpha.6467724
banyancode@26.7.48
banyancode@26.7.47
@bonsai-ai/claude-code@2.1.141
@bonsai-ai/claude-code@2.1.220
@dbx-app/mcp-win32-x64@0.4.44
@dbx-app/mcp-win32-arm64@0.4.44
@dbx-app/cli-win32-arm64@0.4.44
@dbx-app/cli-win32-x64@0.4.44
devez-vibe@0.1.0
devez-vibe@0.1.1
@fermions-asi-corp/saige-cli-windows-arm64@0.1.0-nightly.1785162609
@fermions-asi-corp/saige-cli-windows-x64@0.1.0-nightly.1785162609
@dagucloud/dagu-win32-x64@2.11.1
banyancode@26.7.46
@vue-vet/win32-x64@0.1.12
@wattetheria/cli-win32-arm64@0.5.1
@wattetheria/cli-win32-x64@0.5.1
@wattetheria/cli-win32-x64@0.5.0
@wattetheria/cli-win32-arm64@0.5.0
@librefang/cli-win32-arm64@2026.7.27
@librefang/cli-win32-x64@2026.7.27
@leyen/coder-win32-x64@0.1.154
banyancode@26.7.44
banyancode@26.7.45
@lute-lang/lute-core-win32-x64@0.8.0
@lute-lang/lute-core-win32-x64@0.7.0
@keydris/cli-win32-x64@0.1.0-next.1

PkgRadar attributes coordinated supply-chain campaigns and blocks their packages at the CI gate. Start free or see all tracked campaigns.