Act
active
Fake Web3 Accelerator Spreads Malware via Malicious npm Packages
- Engineer — Act: This is an active supply-chain attack delivered through npm packages targeting developers with AI-credit lures — directly in scope for anyone managing a Node.js dependency tree. Audit recently added npm packages against known-good lockfiles and brief developers to treat unsolicited Web3/AI accelerator invitations as a red flag.
- SOC/IR — Plan: The campaign deposits infostealers and backdoors on developer endpoints; no specific IOCs are published in this summary, but the TTP warrants building or tuning detections for anomalous npm install activity followed by credential-access or outbound C2 behavior on developer workstations.
- Leader — Learn: This campaign illustrates a growing AI-lure social-engineering pattern aimed specifically at technical staff; no immediate leadership action is required, but it provides useful framing for updating developer-focused security awareness content.
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.