Tag: npm packages

6 Attack Reports | 0 Vulnerabilities

Attack reports

140+ npm Packages Compromised in Coordinated Supply Chain Attack

More than 140 Mastra npm packages were compromised through a supply chain attack that injected a typosquatted dependency called easy-day-js. A single npm account published malicious versions within a short timeframe, affecting packages including @mastra/core with over 918K weekly downloads. The att…

cryptocurrency theft

supply chain attack

persistence mechanism

cross-platform stealer

postinstall hook

Published: June 17, 2026

Downloadable IOCs: 7

The Worm That Keeps on Digging: Latest Wave

A sophisticated supply chain campaign targeting the open source developer ecosystem has emerged, compromising NPM packages in the @antv namespace, GitHub Actions including actions-cool/issues-helper, and the VSCode extension nrwl.angular-console. The malware initiates multi-stage infection chains u…

credential theft

supply chain attack

developer environments

backdoor persistence

cicd compromise

vscode extension

Published: May 19, 2026

Downloadable IOCs: 1

Supply Chain Attack Hits SAP CAP and Cloud MTA npm Packages

Multiple npm packages in the SAP JavaScript and cloud application development ecosystem were compromised in a suspected supply chain attack. Affected packages include [email protected], @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]. The compromised versions introduced malicio…

credential-theft

supply-chain-attack

ci-cd-compromise

Published: April 30, 2026

Downloadable IOCs: 4

Supply Chain Campaign Targets SAP npm Packages with Credential-Stealing Malware

A supply chain operation dubbed 'Mini Shai Hulud' compromised SAP-related npm packages by injecting malicious preinstall scripts that execute during installation. The campaign leverages multi-stage payloads to harvest developer and CI/CD secrets from GitHub, npm, and major cloud providers, exfiltra…

credential theft

supply chain attack

ci/cd compromise

github exfiltration

mini shai hulud

Published: April 30, 2026

Downloadable IOCs: 10

The npm Threat Landscape: Attack Surface and Mitigations

The npm ecosystem experienced a critical shift in September 2025 with the Shai-Hulud worm, marking the transition from isolated attacks to systematic supply chain compromises. In April 2026, TeamPCP launched a coordinated campaign through a malicious @bitwarden/cli package targeting multiple distri…

credential harvesting

ci/cd compromise

worm propagation

self-replicating malware

Published: April 25, 2026

Downloadable IOCs: 4

Fake recruiter campaign targets crypto developers with RAT

A sophisticated fake recruitment campaign named 'graphalgo' has been active since May 2025, targeting JavaScript and Python developers in the cryptocurrency sector. Attackers approach victims through LinkedIn, Facebook, and Reddit with fabricated job opportunities from fake blockchain companies lik…

supply chain attack

cryptocurrency targeting

fake recruitment

javascript developers

python developers

terminalcolor256

Published: April 13, 2026

Downloadable IOCs: 61

Click here to see more Attack Reports