165 Malicious npm and PyPI Packages in One Week, Several Targeting AI Tooling

npm and PyPI, with clusters impersonating AI, automation, and Model Context Protocol tooling

Xygeni confirmed 165 malicious packages published between July 17 and July 24, 2026. The highest-volume single event was the PyPI package `bingo-ai`, which pushed roughly 85 versions inside a 23-minute window on July 21 using the same automated publishing pattern flagged the previous week. `gcli-control` on PyPI shipped a full-featured Windows remote access trojan with keylogging, webcam and microphone capture, clipboard monitoring, and credential theft, escalating through versions 0.1.0 to 0.7.1 in about 13.5 hours on July 21-22 and continuing to 0.12.0 by July 24. Also flagged were the npm packages `@knofler/ai-management` (confirmed July 22) and `n8n-nodes-pwn`, a fake automation node published July 22

Automated bulk publishing against registries with no meaningful pre-publication review, combined with AI-themed and automation-themed names chosen so that developers and coding agents resolving unfamiliar package names land on attacker-controlled code