57 results for “npm packages”

OpenSourceMalware traces nine itsa-* npm package versions published on 4 May 2025 from a hijacked maintainer account to the PolinRider campaign, eight months before documented victims. It decodes the EtherHiding chain (BNB Smart Chain and Ethereum calldata, JADESNOW, INVISIBLEFERRET bootstrapper, Socket.IO RAT, Python stealer) and links the 2025 sample to 2026 force-push infections. It lists IOCs, hashes, a timeline and hunting guidance.

opensourcemalware.comwriteupPublished and added 30 Oct 2026🛡️ Security

Endor Labs breaks down the May 11, 2026 compromise of 42 @tanstack/* npm packages (84 malicious versions) that carried valid SLSA provenance. The attacker chained a pull_request_target "Pwn Request", GitHub Actions cache poisoning across the fork/base boundary, and OIDC token extraction from Runner.Worker memory, then published directly to npm without stealing any credential. It explains why 2FA, trusted publishing, provenance and branch protection all failed, and lists mitigations: split pull_request_target workflows, treat the cache as untrusted, scope id-token: write to a publish job, pin actions to SHAs, require environment approval, use egress allowlists.

endorlabs.comwriteupPublished and added 12 Oct 2026🛡️ Security

Orca Security details "MALFEX," a supply-chain campaign active since August 2023 in which a suspected lone Brazilian threat actor published eight malicious npm packages (tlxbnhd, tldriver, mxdriver, img-to-native, native-runner, function-flag, function-color, cdn-img-fetch) that together drew over 40,767 downloads. Using postinstall lifecycle hooks, the packages deliver three malware families to Windows hosts: the Go-based Overlord RAT (with a Solana blockchain C2 resolver), the Node.js "movinlike" credential/Discord/crypto-wallet stealer, and rotating downloader payloads — with three packages (notably function-flag) still live on npm and only six of the eight carrying OSV advisories at publication time. The piece includes host IOCs (file paths, scheduled task name), affected package lists, and remediation steps (lockfile auditing, credential rotation) alongside a pitch for Orca's SCA detection of the OSV-flagged packages.

orca.securityarticlePublished and added 8 Oct 2026🛡️ Security

StepSecurity details how tensorlake@0.5.144 was pushed to npm after malicious commits landed directly on the tensorlakeai/tensorlake GitHub repo's main branch under a maintainer's identity, carrying a valid npm provenance attestation despite being malicious. The preinstall hook downloads Bun to run an obfuscated payload that steals GitHub/npm tokens, cloud and Vault/Kubernetes secrets, SSH keys, browser logins, and AI-tool configs (Claude, Cursor, Windsurf), then self-propagates by republishing stolen npm packages and committing persistence files (.claude/settings.json, .vscode/tasks.json) to reachable repos. A "hostage token" mechanism installs a gh-token-monitor service that runs a home-directory wipe if the stolen GitHub token is revoked before the monitor is removed, inverting the normal incident-response order.

stepsecurity.iowriteupPublished and added 8 Oct 2026🛡️ Security

A dated research report (Pennyforge, 2026-10-02) that probes the live MCP ecosystem to show it is fragmented across five spec revisions at once: it POSTs initialize/server/discover calls against 186 deduplicated endpoints pulled from the official MCP registry's v0 API, plus 10 popular npm stdio servers spawned via npx. It finds only ~9.7% of responding endpoints speak the new stateless 2026-07-28 wire (which removes Mcp-Session-Id, the initialize handshake, and adds server/discover), that the flagship @modelcontextprotocol/server npm packages still only speak the older 2025-06-18 revision, and documents a "version-echo" methodology pitfall where servers negotiate within a supported range rather than reporting a fixed version — illustrated with a parallel failure mode found in the x402 payment protocol.

dev.towriteupPublished and added 2 Oct 2026🧠 AI

Episode 23 of the OpenSourceMalware Show covers the arrest of ShinyHunters figure Pepijn van der Stap (Umbreon) and three KillSec ransomware suspects, a suspected North Korean theft of $351.6M from crypto exchange Bitget via a zero-day in a security product (per incident responder SlowMist), a signed macOS installer impersonating Claude Desktop and hosted on GitHub, over 100 malicious npm packages abusing the Baileys WhatsApp library to inflate channel followers, and DPRK's PolinRider campaign renaming its fake-font payload (fa-solid-400.woff2 variants, now using a .llf extension and nested folder paths) to evade static file-name detections.

opensourcemalware.comtalkAdded 1 Oct 2026, published 2 Oct 2026🛡️ Security

CloudSEK's Global Threat Intelligence team uncovered MALFEX, a supply-chain campaign active since August 2023 that uses malicious npm packages (including tlxbnhd, tldriver, mxdriver, img-to-native, cdn-img-fetch, function-flag, function-color) to deliver malware on Windows. One chain disguises a Windows executable as a PNG to load Overlord RAT, an open-source Go-based RAT that uses the Solana blockchain to resolve C2 addresses; a second chain fetches a 64MB Node.js bundle that steals Discord tokens, browser cookies/credentials, crypto wallets and Telegram session data, exfiltrating via a Discord webhook. Some malicious packages stayed live for over a year even after related packages were pulled or flagged.

hackread.comarticleAdded 3 Oct 2026, published 30 Sep 2026🛡️ Security

The Hacker News details a campaign of nearly 800 (later 1,033) malicious npm packages delivering the WEL1DROPPER downloader — dubbed Flooding Dropper by Sonatype — which fetches cross-platform RAT/infostealer payloads via Cloudflare Workers or DNS TXT-record fallback from wel1.ru, patches ETW/AMSI on Windows, and deploys the Sliver C2 framework on Linux. The piece also covers a related npm crypto-stealer campaign, multiple npm/PyPI packages tied to EtherHiding droppers and credential theft (Solana wallets, .env secrets, Discord/GitHub Actions tokens), and Chrome extensions abusing a bandwidth-sharing SDK to turn browsers into residential-proxy web scrapers.

thehackernews.comarticleAdded 26 Sep 2026🛡️ Security

Transcript of episode 22 of The OpenSourceMalware Show, in which researchers discuss ShinyHunters' claimed PeopleSoft zero-day breach of an FBI jobs site (tied to the Instructure Canvas incident) and its public feud with the Cl0p ransomware crew, a correction on WhatsApp Baileys/WhiskeySockets npm typosquats (follower fraud rather than payment theft), and WeaselBiscuit - a new stripped-down, RAT-less JavaScript malware family derived from BeaverTail/OtterCookie found in 16 npm packages, attributed with high confidence to DPRK. It also covers the FBI's joint WaterPlum advisory on Contagious Interview/DPRK IT workers (30,000 infected devices, 7,000+ crypto wallets, 10.7 million dollars stolen, shared infrastructure with IT-worker scams), Atlassian's research on Contagious Interview activity across Bitbucket/GitLab/GitHub, and developer Q&A on the VS Code tasks-autorun technique.

opensourcemalware.comtalkAdded 24 Sep 2026, published 25 Sep 2026🛡️ Security

DistillGuard is a malicious NPM package detection framework that extracts multi-granular features via static graph analysis of install/import/runtime behavior, then uses an online LLM to distill security knowledge into structured labels used to LoRA-fine-tune a Qwen3-8B model for offline deployment. It reports 95.3% accuracy, 99.4% precision, and an 93.8% F1 score, beating baselines by 11.1-30.0 F1 points, and the authors catalog eight typical API attack chains observed in malicious npm packages.

arxiv.orgpaperAdded 4 Oct 2026, published 24 Sep 2026🛡️ Security

Socket's Threat Research Team details a supply-chain compromise of four @asyncapi npm packages (generator-helpers, generator-components, generator, specs) published via a poisoned source commit through GitHub Actions trusted publishing. The packages contain an obfuscated load-time (not install-hook) implant that spawns a detached Node.js process to fetch an IPFS-hosted, AES-256-GCM-encrypted loader delivering the "Miasma" botnet/tasking framework, which supports REST C2, multi-channel comms (Nostr, IPFS, Ethereum RPC, BitTorrent DHT), shell execution, file exfiltration, and systemd persistence. Includes full technical analysis, IOCs, hashes, and MITRE ATT&CK mapping.

socket.devwriteupAdded 21 Sep 2026🛡️ Security

Socket's research team found two beta releases of the @joyfill npm packages (@joyfill/layouts and @joyfill/components) contained an import-time JavaScript implant that resolves encrypted payloads through Tron, Aptos, and BNB Smart Chain transactions, ultimately dropping a 77KB Node.js remote-access trojan matching the DEV#POPPER family and sharing loader fingerprints with the PolinRider blockchain-loader campaign. The RAT establishes a Socket.IO C2 channel, executes arbitrary JS/shell commands, exfiltrates files and clipboard data, and persists by patching files inside VS Code, Cursor, Antigravity, Discord Desktop, GitHub Desktop, and the global npm CLI; a parallel detached-process branch fetches an additional bootstrap that can deploy a Python credential/browser-data stealer assessed as an OmniStealer variant. Because the implant fires on module load (not via npm lifecycle scripts), `--ignore-scripts` provides no protection, and the writeup includes full IOCs, blockchain addresses, C2 infrastructure, and MITRE ATT&CK mappings.

socket.devwriteupAdded 22 Sep 2026, published 20 Sep 2026🛡️ Security

OpenSourceMalware researchers detail WeaselBiscuit, a newly discovered lightweight JavaScript infostealer found hidden in 11+ npm packages (e.g. process-tailwind, engin1, the @biz44 scope), which shares tradecraft with DPRK-linked BeaverTail/OtterCookie but strips out wallet-draining, password decryption, and remote-shell features. The writeup walks through the full infection chain - a package auto-running a detached Node loader, fetching a Base64-encoded second stage from Npoint dead-drop URLs, and beaconing to a hardcoded HTTP C2 (103.170.217.184:8787) - plus its capabilities (Chrome extension-storage theft, clipboard capture, Windows keylogging) and a campaign-cluster graph tying packages together via shared hashes and resolver URLs. Attribution to DPRK is explicitly labeled a tentative hypothesis rather than confirmed.

opensourcemalware.comwriteupPublished and added 17 Sep 2026🛡️ Security

GitHub added cache-mode to Actions, a least-privilege control (read/write/write-only/none) that limits which workflows can restore or save entries in the shared Actions cache, targeting the cache poisoning technique used to compromise Ultralytics (PyPI) and the TanStack npm packages via a pull_request_target pwn request. Job-level settings override workflow-level ones, the mode propagates through reusable workflows, and GitHub warns when write access is granted to low-trust events; write-only was added after feedback from researcher Adnan Khan. The article notes build provenance (SLSA/Sigstore) doesn't catch a poisoned cache since it only attests to build origin, not input integrity, and recommends cache-mode: none for AI agent workflows exposed to prompt injection, referencing the Cline compromise.

socket.devarticleAdded 21 Sep 2026, published 16 Sep 2026🛡️ Security

A comparison of GitHub's Dependabot and the open-source Renovate bot as automated dependency-update tools, covering setup, platform/monorepo support, PR noise, and how each handles security advisories versus transitive dependencies. The article argues both tools only bump version numbers rather than assessing exploitability, using the xz-utils backdoor, compromised chalk/debug npm packages, and a breaking lodash 4.18.0 patch as examples of why blind auto-updates can introduce new risk, then pitches Aikido Security's reachability-based backporting and AutoFix as the fix.

aikido.devarticleAdded 15 Sep 2026, published 14 Sep 2026🛡️ Security

Episode 20 of The OpenSourceMalware Show covers a Mini Shai-Hulud payload (from the May AntV campaign) that resurfaced in four npm packages published within the same hour on September 7th, having sat undetected via hash matching for 111 days despite npm's claimed publish-time scanning. The hosts also recap Q&A from Team Cymru's Underground Economy conference on why DPRK and Russia don't collaborate on supply-chain attacks, why malicious open source rarely targets specific countries/regions, and why GitHub's lack of git-commit authentication lets threat actors like PolinRider rewrite history undetected across 9,000+ confirmed compromised repositories. Includes commentary on commit signing as a partial mitigation and criticism of GitHub's security responsiveness compared to GitLab.

opensourcemalware.comtalkPublished and added 9 Sep 2026🛡️ Security

StepSecurity introduces Secure Registry, a proxy/registry-layer control that inspects and blocks malicious npm packages at install time, aiming to stop supply-chain attacks like malicious postinstall scripts, typosquats, and dependency confusion before they execute in CI/CD or developer environments. It positions itself as a preventive layer complementary to post-hoc scanning, sitting between developers/CI and the npm registry.

stepsecurity.ioarticleAdded 5 Sep 2026🛡️ Security

StepSecurity announces Linux support (Debian/RPM, .deb and .rpm packages) for Dev Machine Guard, its open-source developer-machine inventory and scanning engine, extending existing macOS/Windows coverage. The tool detects installed AI coding agents (Claude, Cursor, GitHub Copilot, Codex), IDE extensions from VS Code Marketplace and OpenVSX, MCP server configs, npm packages, and Linux system packages (rpm, dpkg, pacman, apk, snap, flatpak) via native mechanisms like systemd user timers and BIOS-serial device identity, and is explicitly framed as a response to incidents like the Shai-Hulud npm worm, s1ngularity/Nx compromise, and Mini Shai-Hulud/TanStack attacks. It ships in a free local-only Community mode and a paid Enterprise mode with centralized dashboard, policy enforcement, and dependency cooldown/alerting.

stepsecurity.ioarticleAdded 5 Sep 2026🛡️ Security

StepSecurity announces Windows 10/11 support (x64 and ARM64, Sigstore-signed with build provenance) for Dev Machine Guard, its open-source developer-endpoint scanner. It inventories AI coding agents, MCP server configs, IDE extensions from the VS Code Marketplace and OpenVSX, and global and per-project npm packages. This lets teams find which developer machines have a compromised package or extension after incidents like Shai-Hulud, s1ngularity and Mini Shai-Hulud. Windows detection uses %LOCALAPPDATA%, %PROGRAMFILES%, registry Uninstall keys and schtasks scheduling. Community mode runs fully locally, while enterprise mode reports to a dashboard with policy enforcement.

stepsecurity.ioarticleAdded 5 Sep 2026🛡️ Security

JFrog describes how AI coding agents like Cursor and Claude Code autonomously select and download dependencies directly from public registries (npm, PyPI, Maven, Go, Docker Hub, Helm, NuGet), bypassing organizational curation, scanning, and audit controls entirely. It cites JFrog's 2026 State of the Union data (451% surge in malicious npm packages, ~20% of AI package recommendations referencing non-existent "slopsquatted" packages) and announces Agent Package Resolution, a JFrog Artifactory feature that transparently routes agent-driven package installs through existing curation/Xray scanning policies via session steering, persistent package-manager config, and server-side enforcement.

jfrog.comarticlePublished and added 25 Aug 2026🛡️ Security

OpenSourceMalware's case study on npm packages fetch-page-assets and html-to-gutenberg, maintained by a legitimate developer (DiogoAngelim) whose GitHub account was compromised by the DPRK-linked PolinRider campaign in March 2026. The post shows GitHub server-side push timestamps proving all seven of the maintainer's repos were force-pushed with an identical NullReceiver loader in two coordinated bursts, and that after npm pulled the flagged v1.2.9 (GHSA-vxq2-vhm7-7mhq), every subsequent release (v1.2.10-v1.2.14) kept shipping the same .vscode/tasks.json auto-run trigger, with the attacker later adding a second obfuscated payload appended to babel.config.cjs. It argues npm/GitHub's per-version advisory model can't scale against thousands of PolinRider-compromised maintainers and lists specific IOCs (hashes, C2 wallet, RPC endpoints).

opensourcemalware.comwriteupAdded 3 Sep 2026, published 25 Aug 2026🛡️ Security

Manifold Security identified 77 malicious "evil twin" extensions uploaded to Open VSX between July 26 and August 1, 2026, that impersonate real Microsoft VS Code Marketplace extensions by reusing their names/namespaces/descriptions under unrelated publisher accounts at low version numbers (e.g. 0.0.1). 58 lightweight variants exfiltrate just the hostname while 19 "recon" variants collect detailed machine, Git repository, CI environment (GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps, Buildkite, CircleCI, Codespaces, Gitpod), installed-extension, and telemetry opt-out data to mangorbit[.]com, with DNS TXT-based fallback C2 and a persistent multi-day retry schedule. The article also covers the concurrent ChainDrop campaign compromising 450 npm packages (2,244 artifacts) via a Mini Shai-Hulud self-propagating credential-stealing worm using a Bun runtime payload and preinstall hooks, which plants persistence via .claude and .vscode config injection.

thehackernews.comarticlePublished and added 8 Aug 2026🛡️ Security

OpenSourceMalware documents WEL1DROPPER (aka Flooding Dropper), a campaign that published 788+ slopsquatted npm packages (e.g. checkout-mobile-bnpl) which execute on require() with no install script, downloading cross-platform RAT/infostealer payloads via rotating Cloudflare Workers URLs with a DNS TXT-record fallback channel. The writeup reverse-engineers the Linux (UPX-packed ELF) and macOS (universal Mach-O) second-stage payloads, detailing anti-analysis checks, LaunchAgent persistence disguised as com.apple.windowserver.helper, XOR-obfuscated C2 domains, a suspected Sliver C2 final stage, and ties the campaign to Russian financial-sector lures and the earlier Moika npm campaign.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 6 Aug 2026🛡️ Security

npm-scan is a CLI supply-chain security scanner (@lateos/npm-scan) that inspects npm packages and lockfiles for behavioral attack patterns missed by npm audit/Snyk/Socket, including obfuscated payloads, credential stealers, eBPF kernel rootkits, memory-level OIDC token extraction, GitHub maintainer-account spoofing, and AI-platform-targeted key theft. It ships 23 detectors (D1-D25), validated against real campaigns like IronWorm and Miasma, and outputs SBOM (CycloneDX/SPDX) and SARIF for GitHub Security, plus a workflow to submit critical findings to CISA's VINCE with mandatory manual review. It's free (MIT) for individuals/OSS/evaluation, with paid commercial tiers ($799-$9,900/yr).

github.comrepoPublished and added 5 Aug 2026🛡️ Security

Wiz Research documents an ongoing supply chain attack in which a compromised GitHub maintainer account was used to publish malicious versions of keyv, cacheable, and 400+ dependent npm packages. The payload is a variant of the open-sourced 'Mini' Shai-Hulud malware (linked to the TeamPCP and antv campaigns) that steals cloud, CI/CD, AI-agent, and cryptocurrency credentials, persists via Claude Code hooks and VS Code tasks.json, exfiltrates data to attacker-controlled GitHub repos, and retrieves its C2 domain dynamically via an Ethereum smart contract (StringListStore) eth_call rather than hardcoding it.

wiz.iowriteupAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security

Aikido Security reports that Keyv and several related npm packages were compromised as part of the ongoing Shai-Hulud supply-chain attack, in which malicious versions were published to npm to spread a self-replicating worm across the ecosystem. The write-up details the affected packages and versions and the worm's propagation mechanism via compromised maintainer credentials and postinstall scripts.

aikido.devadvisoryAdded 3 Sep 2026, published 4 Aug 2026🛡️ Security

ChainDrop is an npm worm that compromised hundreds of packages on 4 August 2026, some with over 150 million weekly downloads, starting from a malicious commit (174f6a5) in the keyv repository. Datadog dissects the Bun-based loader, the obfuscated second stage, credential theft (files, GitHub Actions runner memory, AWS, Kubernetes, Vault), Ethereum smart-contract C2 discovery, AES/RSA exfiltration, an eval channel, and propagation via stolen npm tokens, GitHub branches and Sigstore provenance. IOCs and a list of affected packages are included.

securitylabs.datadoghq.comwriteupAdded 29 Oct 2026, published 4 Aug 2026🛡️ Security

Researchers analyzing the DPRK-linked npm packages bianira-ui@1.27.0 and fluid-type-ui@2.0.8 (Contagious Interview campaign, trojanized clones of Tailwind CSS plugins) identified NullReceiver, a new blockchain C2-resolution technique that encodes the C2 IP address directly in the bytes of the recipient address of a zero-value, zero-data Ethereum transfer, rather than in calldata as with EtherHiding. Because it uses a disposable, never-reused destination address and carries no data field, it avoids the fixed "burn address" landmark that let Google's GTIG detect EtherHiding, making it harder to fingerprint. The writeup includes the malware's wallet-lookup logic, a code snippet, and full IOCs (packages, attacker wallet, encoded address, C2 IPs).

opensourcemalware.comwriteupAdded 3 Sep 2026, published 2 Aug 2026🛡️ Security

OpenSourceMalware's research ties together JFrog's, Nextron's, and Socket's separate reports on compromised html-to-gutenberg/fetch-page-assets npm packages, 16 Go modules, and Joyfill's poisoned beta releases, attributing all of them to DPRK's PolinRider campaign via shared XOR keys, TRON/Aptos wallets, C2 infrastructure, and the fa-solid-400.woff2 loader file hash. The piece argues these aren't targeted account takeovers but automated propagation from infected maintainer machines (via temp_auto_push.bat git history rewriting and stolen .npmrc tokens), and uses GH Archive to prove that 43 of 64 analyzed Go module pseudo-version timestamps were forged to appear years older than the actual malicious push. Delivered payloads include InvisibleFerret/DEV#POPPER RAT and the OmniStealer Python infostealer, and the article links a PolinRider crossover into a compromised Packagist/PHP package (roberts/leads) via shared C2 infrastructure.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 31 Jul 2026🛡️ Security

StepSecurity dissects malicious beta versions of @joyfill/components and @joyfill/layouts published to npm on July 28, 2026, which inject a five-stage obfuscated payload that executes on import rather than via a postinstall hook, so npm install --ignore-scripts does not stop it. The chain resolves its C2 server by reading a transaction on the Tron blockchain (with Aptos as fallback), decrypts a BNB Smart Chain transaction to find the next stage, and deploys a Socket.IO remote access trojan with worm-like self-propagation that patches the global npm CLI, VS Code/Cursor's @vscode/deviceid module, Discord desktop, and GitHub Desktop, plus a Python credential stealer targeting browser data, wallets, and Git/GitHub tokens. The writeup includes fully deobfuscated source code, IOCs (C2 IPs, Tron addresses, file hashes), and results from detonating the packages under Harden-Runner in a sandbox.

stepsecurity.iowriteupAdded 3 Sep 2026, published 30 Jul 2026🛡️ Security

OpenSourceMalware analyzes Checkmarx Zero's ChainVeil (nine malicious npm packages using a 77KB RAT and a TRON/Aptos/BSC blockchain C2 channel) and ViteVenom (seven Vite-ecosystem typosquats) reports, and shows five values -- two TRON wallets, one Aptos address, and two XOR decryption keys -- are byte-for-byte identical to infrastructure they published in March for the DPRK/Lazarus Group campaign PolinRider, predating Checkmarx's report by over 70 days. They conclude ChainVeil/ViteVenom (maintainer "successkeyteck"/SuccessKey) are PolinRider running directly against npm and Vite, and list the full chronological table of typosquatted packages, versions, and maintainers.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 17 Jul 2026🛡️ Security

Weekly OpenSourceMalware podcast episode covering four security stories: GitHub enabling a default 3-day Dependabot cooldown to blunt account-takeover malware; the JScrambler npm compromise where a stolen/unknown publishing credential was used to push five malicious versions (moving the trigger from a pre-install script to on-import execution) plus four pinned dependent packages; the AsyncAPI compromise via a 58-day-unpatched GitHub Actions pull_request_target flaw that let attackers steal a privileged token and publish malicious @asyncapi npm packages containing components derived from the open-sourced Miasma malware; and new PolinRider (DPRK-linked) research showing a 6.5x rise in confirmed poisoned repos since March, with 94% of payloads delivered via JavaScript config-file injection and the rest via fake font files, plus multiple redundant triggers via VS Code task.json and git post-checkout/pre-commit hooks targeting individual developers previously compromised via Contagious Interview/TasksJacker.

opensourcemalware.comtalkAdded 3 Sep 2026, published 16 Jul 2026🛡️ Security

Wiz Research details how an attacker used 37 decoy pull requests to mask exploitation of a pull_request_target "pwn request" misconfiguration in the asyncapi/generator GitHub Actions workflow, stealing a privileged PAT belonging to the asyncapi-bot service account. The attacker then published four malicious npm packages (five versions) under the @asyncapi namespace with over 3 million weekly downloads, delivering a self-identified "M-RED-TEAM v6.4" multi-stage payload that fetches an 8.25MB encrypted bundle from IPFS and installs a 92,000-line trojan framework with systemd persistence and HTTP/Nostr/Ethereum/libp2p C2 channels, targeting browser credentials, SSH keys, npm/GitHub tokens, AWS credentials, and crypto wallets. The piece also analyzes partial technical overlap with the Miasma malware framework and the unrelated prt-scan campaign without making definitive attribution.

wiz.iowriteupAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

Aikido Security details how five @asyncapi npm packages (specs, generator, generator-helpers, generator-components), combined ~2.9M weekly downloads, were backdoored after an attacker exploited an unmerged pull_request_target GitHub Actions vulnerability in asyncapi/generator to steal the npm publish token via 37 flooded PRs. The injected runtime code spawns a detached Node process that downloads an encrypted stage-2 loader from IPFS, decrypts it via HKDF/AES-256-GCM, and drops a persistent remote-shell implant self-identified as 'M-RED-TEAM v6.4' with Miasma-branded artifacts, though credential harvesting and self-propagation are disabled in this build. The post includes full technical detail on the exfiltration flow, IOC strings, IPFS CIDs, and inconclusive attribution linking it to the prior Miasma toolkit and prt-scan campaign.

aikido.devwriteupAdded 3 Sep 2026, published 14 Jul 2026🛡️ Security

Aikido describes the internal architecture of Aikido Intel, its real-time supply-chain intelligence feed that monitors over 4 million packages across ecosystems like npm, PyPI, and Packagist for malware and undisclosed vulnerabilities. The pipeline combines extraction/deobfuscation, static rule matching (Opengrep, YARA-X), npm sandbox detonation for dynamic behavior analysis, an AI triage layer that traces cross-file attack chains, and human researcher review, claiming median detection times under 6-8 minutes and citing their role in surfacing s1ngularity and the Shai-Hulud/Shai-Hulud 2.0 npm worm campaigns. It also mentions Aikido Safe Chain, a free tool that blocks installs of malicious or very new npm packages, and notes Intel protects Packagist downloads via Composer.

aikido.devarticleAdded 3 Sep 2026, published 13 Jul 2026🛡️ Security

A security research team traces six typosquatted npm packages (anthropic-toolkit, ai-sdk-helpers, ollama-helpers, openai-agents-helpers, @langgraphjs/toolkit, and @aspect-security/argon2) impersonating Anthropic, Vercel, Ollama, OpenAI, LangChain, and Aspect Security back to the founder of a stealth-mode cybersecurity startup. The packages use npm preinstall/postinstall hooks to silently exfiltrate a rich identity fingerprint — hostname, git/GitHub emails, SSH key comments, reflog committer emails, AWS/GCP config metadata, corporate DNS domain, and host project name — to a Google Cloud Run endpoint, while deliberately avoiding literal credentials to look benign and offering a fake telemetry opt-out. The writeup also documents version backfilling to fake package maturity and shows the payload evolving from a crude April beacon to a polished June "identity graph" collector, with full IOCs provided.

opensourcemalware.comwriteupAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

Episode 12 of the OpenSourceMalware Show covers three security stories and features an extended interview with Mikael Barbero, Head of Security at the Eclipse Foundation, about securing Open VSX. The interview details Open VSX's pre-publish YARA/AI-assisted malware scanning pipeline, quarantine-and-human-review workflow, token expiration and revocation overhaul, namespace/publisher verification, and detection of 'sleeper' extensions that turn malicious after an update (as seen with GlassWorm-style campaigns). The quick-hits segment covers Paul McCarty's PolinRider research showing a DPRK automated repo-hijacking campaign spreading into Go and PHP ecosystems via Packagist/Go registry packaging of GitHub repos, a cybersecurity startup caught publishing seven infostealer npm packages to manufacture its own threat data, and MeetingTV's lawsuit against Palo Alto Networks/Koi Security alleging an AI-hallucinated domain on a C2 IOC list caused real business harm.

opensourcemalware.comtalkAdded 3 Sep 2026, published 9 Jul 2026🛡️ Security

Episode 11 of the OpenSourceMalware Show covers npm's new 72-hour read-only account lockout for high-impact packages (triggered by email changes or 2FA recovery use) and GitHub Enterprise's new self-service credential revocation tool for incident response, noting each has gaps (lockout could hinder legitimate ATO recovery; revocation doesn't cover PATs created outside the enterprise boundary). The hosts also call out six npm packages published by a researcher at a stealth cybersecurity startup that target OpenAI, Anthropic, Vercel, and Ollama users — info-stealers that avoid credentials but exfiltrate .git/.ssh data, drawing a parallel to Snyk's 2025 malicious-package incident targeting Cursor. It also references an FBI FLASH notice on TeamPCP's TTPs/IOCs and previews a coming interview with Eclipse Foundation's head of security on Open VSX supply-chain risk.

opensourcemalware.comtalkAdded 3 Sep 2026, published 2 Jul 2026🛡️ Security

StepSecurity reports that multiple npm packages published under the @immobiliarelabs scope, used as Backstage plugins, were compromised and had malicious code injected, likely via a maintainer account or publishing credential takeover. The advisory covers the affected package versions and indicators, warning organizations using these Backstage plugins to check their dependency trees for the compromised releases.

stepsecurity.ioadvisoryAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

StepSecurity documents a June 24, 2026 attack that published malicious versions of 20 Leo Platform npm packages (including leo-logger and leo-sdk) within a 3-second window, using the same "Phantom Gyp" binding.gyp install-hook technique, three-layer obfuscation chain, and Bun runtime evasion seen in the earlier Miasma campaign (57 packages, June 3, 2026). The payload steals GitHub Actions runner memory, cloud/registry/password-manager credentials, exfiltrates via GitHub dead-drop commits using the victim's own token, self-propagates by publishing to any package the victim can access via the npm bypass_2fa mechanism, and escalates privileges via passwordless sudo on runners. The post includes IOCs and maps defenses (Harden-Runner, Secure Registry cooldowns, PR-based compromised-package checks) to each stage of the attack.

stepsecurity.iowriteupAdded 3 Sep 2026, published 1 Jul 2026🛡️ Security

Socket Threat Research documents a new wave of the Miasma Mini Shai-Hulud npm supply-chain campaign compromising @immobiliarelabs Backstage plugins for GitLab integration and LDAP authentication, published on June 26, 2026. The malicious tarballs (e.g. @immobiliarelabs/backstage-plugin-gitlab@7.0.2) add a hidden root-level index.js triggered via the "Phantom Gyp" node-gyp binding.gyp trick, which decrypts an AES-128-GCM payload, bootstraps Bun, and steals npm/GitHub/cloud/SSH/CI-CD secrets while planting GitHub Actions and AI-IDE persistence. The report also traces a plausible root cause to the earlier compromise of codfish/semantic-release-action (tag-hijacking reported by StepSecurity) and highlights abuse of GitHub's deployment event trigger — a technique flagged by researcher Adnan Khan — to run attacker workflows without touching protected workflow files.

socket.devwriteupPublished and added 27 Jun 2026🛡️ Security

Socket's research team documents a supply chain attack in which npm account "ehindero" mass-published 141 malicious versions of @mastra/* packages (including @mastra/core, 918K weekly downloads) that were byte-identical to legitimate code but added a single new dependency: the typosquatted package easy-day-js. That package's postinstall hook (setup.cjs) disables TLS validation, fetches a second-stage cross-platform Node.js implant (protocal.cjs) that installs OS-specific persistence (Windows Run key, macOS LaunchAgent, Linux systemd unit disguised as Node/NVM tooling), inventories 166 cryptocurrency wallet browser extensions, steals Chrome/Edge/Brave history, and accepts arbitrary remote tasking (Node/Shell runners) from a hardcoded C2 over a custom ICAP-style protocol. The writeup includes full IOCs, SHA-256 hashes, and remediation guidance (rotate npm/CI/SSH credentials, treat affected hosts as compromised, disable install scripts).

socket.devwriteupPublished and added 20 Jun 2026🛡️ Security

Aikido details a supply chain attack in which an attacker took over the entire @mastra npm scope, republishing 141 packages (including @mastra/core with 918K weekly downloads) to add a malicious dependency, easy-day-js, a dayjs clone. A staged clean-then-malicious version (1.11.21 → 1.11.22) exploited npm's caret resolution so the postinstall script setup.cjs fetched a second-stage payload from a C2 server, spawned it as a detached background process targeting 160+ browser crypto wallet extensions, and self-deleted to erase forensic evidence. Aikido notes the attack closely mirrors the earlier axios compromise (same Hostwinds infrastructure pattern, decoy-then-malicious staging, postinstall hook, self-deletion).

aikido.devwriteupAdded 3 Sep 2026, published 17 Jun 2026🛡️ Security

pnpm 11.5 fixes a bug where its trustPolicy: no-downgrade check incorrectly flagged npm packages using staged publishing (a 2FA-gated release approval step) as a downgrade from trusted publishing, because pnpm inferred publishing method from the ambiguous _npmUser metadata field. The fix, prompted by a report from Kevin Deng, makes pnpm treat staged-publish approver metadata as the strongest trust signal rather than a fallback to weaker token-based publishing, reducing false-positive supply-chain alerts as npm rolls out staged publishing and trusted publishing in response to credential-theft campaigns like Mini Shai-Hulud.

socket.devarticlePublished and added 13 Jun 2026🛡️ Security

Podcast/show episode from OpenSourceMalware covering the Miasma worm campaign that compromised 32+ Red Hat @redhat-cloud-services npm packages (later 80+ packages, 286+ malicious versions) via abused npm trusted-publishing gaps rather than a GitHub Actions vulnerability, using the first in-the-wild deployment of TeamPCP's open-sourced Mini Shai-Hulud worm code across npm, PyPI, and an LLM-translated RubyGems variant. It also presents six months of OpenSourceMalware threat-report data (npm vs PyPI growth correlation, account takeovers reaching 60-65% of new weekly records, 700+ malicious ClawHub agent skills targeting marketers via SEO/TikTok/Klaviyo themes), and dissects the Moika campaign (~300 packages, oob.moika.tech C2, 260+ threat reports) as a gray-area case mixing bug-bounty-researcher signals with overtly credential-stealing payloads, alongside the long-running phenomenon of bug-bounty researchers accounting for 25-41% of malicious OSV packages and AI-hallucinated package names (e.g. Events Channel) being weaponized as typosquats.

opensourcemalware.comtalkAdded 3 Sep 2026, published 3 Jun 2026🛡️ Security

StepSecurity's analysis of a supply-chain compromise affecting multiple @redhat-cloud-services npm packages, where malicious versions were published to the npm registry. The writeup details which packages/versions were affected and the indicators of compromise, helping downstream consumers assess exposure.

stepsecurity.iowriteupAdded 3 Sep 2026, published 2 Jun 2026🛡️ Security

StepSecurity's technical teardown of the May 2026 compromise of the Nx Console VS Code extension (nrwl.angular-console v18.95.0, 2.2M+ installs), where a stolen contributor GitHub token was used to push a dangling orphan commit to nrwl/nx and publish a malicious extension via stolen VSCE_PAT credentials. The payload silently ran `npx github:nrwl/nx#<sha>` to fetch a heavily obfuscated 498KB Bun/Node credential stealer that harvests secrets from GitHub, npm, AWS, Vault, Kubernetes, 1Password and Claude Code config, exfiltrates via HTTPS/GitHub API/DNS tunneling, installs a macOS Python backdoor using the GitHub Search API as a C2 dead-drop, and can forge valid Sigstore/SLSA provenance attestations for downstream npm packages. The writeup ties this to a later GitHub breach (3,800 repos, attributed to TeamPCP) and provides detection signals, IOCs, and full recovery steps.

stepsecurity.iowriteupAdded 3 Sep 2026, published 2 Jun 2026🛡️ Security

Orca describes the June 1, 2026 compromise of 32 npm packages under the @redhat-cloud-services scope, which came from a hijacked Red Hat employee GitHub account. The attacker injected malicious GitHub Actions workflows into three RedHatInsights repos and used OIDC tokens to publish backdoored versions with valid SLSA provenance. A preinstall hook runs a 4.2 MB obfuscated payload that sweeps CI, cloud, SSH, registry and .env credentials and self-propagates (the "Miasma" worm, attributed to TeamPCP or a copycat using Mini Shai-Hulud tooling). The post lists compromised versions and gives rotation and pinning guidance.

orca.securityarticlePublished and added 2 Jun 2026🛡️ Security

Aikido details a June 2026 compromise of 96 versions across 32 @redhat-cloud-services npm packages (116,991 weekly downloads) with "Miasma," a new variant of the TeamPCP-authored Mini Shai-Hulud credential-stealing worm whose source was open-sourced in May 2026. Attackers compromised a Red Hat employee's GitHub account to push malicious orphan commits containing a GitHub Actions workflow that abused OIDC id-token: write permissions to authenticate to npm's trusted publishing endpoint and republish backdoored packages; each package's preinstall script then ran a 4.2MB obfuscated payload that swept GitHub Actions, AWS, GCP, Azure, Vault, Kubernetes, npm/PyPI, SSH, Docker, GPG, and .env credentials. The piece also lays out the broader Mini Shai-Hulud campaign timeline (Bitwarden CLI, SAP, PyTorch Lightning, Mistral/TanStack, Microsoft DurableTask) and full IOC package/version list.

aikido.devwriteupAdded 3 Sep 2026, published 1 Jun 2026🛡️ Security

Test summary.

wiz.iowriteupAdded 3 Sep 2026, published 1 Jun 2026🛡️ Security

Snyk researchers discovered malicious code injected into several @redhat-cloud-services npm packages, dubbed the "Miasma" supply chain attack. The malicious payload was designed to harvest sensitive data or execute unauthorized code when the compromised packages were installed, illustrating how trusted-looking scoped npm packages tied to a major vendor namespace can be weaponized.

snyk.iowriteupAdded 3 Sep 2026, published 1 Jun 2026🛡️ Security

Socket researchers uncovered TrapDoor, a coordinated crypto-stealer campaign spanning 34+ malicious packages and 384+ versions across npm, PyPI, and Crates.io, targeting crypto, DeFi, Sui/Move, and AI developer communities. The npm packages use postinstall hooks to run a shared trap-core.js payload that harvests SSH keys, AWS/GitHub credentials, wallet data, and browser data, then persists via .cursorrules, CLAUDE.md, git/shell hooks, systemd, cron, and SSH lateral movement; PyPI packages fetch and run remote JS on import, and Crates.io packages use malicious build.rs to XOR-encrypt and exfiltrate Sui/Move keystores to GitHub Gists. The attacker (GitHub account ddjidd564) also opened PRs against major AI/dev tooling repos (browser-use, LangChain, Langflow, llama_index, MetaGPT, OpenHands) attempting to plant hidden .cursorrules/CLAUDE.md instructions designed to trick AI coding assistants into running exfiltration under the guise of a 'security scan'.

socket.devwriteupPublished and added 26 May 2026🛡️ Security

JFrog previews its 2026 Software Supply Chain Security State of the Union report, drawing on 18.2 billion analyzed artifacts and a 1,508-person survey to describe an "illusion of mastery" gap between claimed governance and actual pipeline enforcement. It cites specific findings: 495 malicious models found on Hugging Face despite 97% of orgs claiming certified AI model governance, 171,592 malicious npm packages detected in 2025 (up 451%) with malicious-package detection flat at 40%, 96% of NVD-Critical CVEs downgraded on real-world exploitability, only 28% of orgs running secrets detection despite 17,637 exposed tokens found (3,260 still active), a CVSS 9.6 RCE in mcp-remote, 56 malicious OpenVSX IDE extensions, and references to the GlassWorm and s1ngularity supply-chain attacks.

jfrog.comarticlePublished and added 21 May 2026🛡️ Security

Socket's Threat Research team found 84 compromised @tanstack npm package artifacts (including @tanstack/react-router, 12M+ weekly downloads) injected with an obfuscated router_init.js credential-stealing payload targeting GitHub Actions CI secrets and OIDC tokens. The attack chained a pull_request_target "Pwn Request" pattern, GitHub Actions cache poisoning across the fork-to-base trust boundary, and runtime OIDC token extraction, allowing attacker publishes via TanStack's legitimate trusted-publisher OIDC binding without stealing npm tokens. Socket ties it to the ongoing Mini Shai-Hulud campaign, attributed to a likely-compromised GitHub account, and provides hashes, IOCs (filev2.getsession[.]org), and hardening/remediation steps.

socket.devwriteupPublished and added 20 May 2026🛡️ Security

Aikido Security reports that Microsoft's durabletask package on PyPI was compromised in a new "mini" wave of the Shai Hulud self-propagating supply-chain worm, which previously hit npm packages and spreads by stealing credentials and republishing malicious versions of dependencies. The post covers indicators of compromise, the malicious payload behavior, and which packages/versions are affected.

aikido.devwriteupAdded 3 Sep 2026, published 19 May 2026🛡️ Security

Socket documents a TeamPCP-linked supply chain attack compromising four SAP-affiliated npm packages (mbt, @cap-js/sqlite, @cap-js/db-service, @cap-js/postgres) via a malicious preinstall script that downloads and runs Bun to execute an 11.7MB obfuscated payload. The payload steals SSH keys, cloud/K8s/npm/GitHub credentials, AI tool configs, and crypto wallets, scrapes secrets from CI runner memory bypassing log masking, exfiltrates via attacker-created GitHub repos, self-propagates by publishing trojanized versions of hardcoded SAP CAP dependencies, and persists via Claude Code and VSCode hooks. Socket attributes the campaign with medium confidence to TeamPCP based on shared __decodeScrambled cipher, Russian-locale kill switch, and GitHub-as-C2 patterns previously seen in Checkmarx, Bitwarden CLI, and Trivy incidents.

socket.devwriteupPublished and added 6 May 2026🛡️ Security

Socket's Threat Research team confirms intercom-client@7.0.4, the official Intercom Node.js SDK (~360k weekly downloads), was compromised via a preinstall hook (setup.mjs) that downloads an unverified Bun binary and executes an 11.7MB obfuscated payload (router_runtime.js) which harvests Kubernetes and Vault credentials and exfiltrates them via the GitHub API. The compromise traces to a hijacked maintainer GitHub account (nhur) that pushed spoofed Dependabot-style workflow changes to trigger the npm publish CI pipeline, and the payload closely matches the 'Mini Shai-Hulud' campaign also seen in a PyPI package (lightning) and prior SAP CAP/Cloud MTA npm packages linked to TeamPCP activity.

socket.devarticlePublished and added 6 May 2026🛡️ Security