tag: Npm · 19 items
- Engineer — Learn: This highlights npm and its mirrors being misused as hosting infrastructure for phishing redirects — not a package-level supply-chain attack, but a reminder that npm CDN URLs can surface malicious HTML content. No patch or config change needed today; worth noting if internal tooling renders or fetches npm-hosted content for users.
- SOC/IR — Learn: A novel phishing delivery technique using trusted npm mirror domains as redirect hosts; without specific IOCs in this report, there is no immediate hunt to run, but analysts should track for follow-on reporting with domains or URLs to add to proxy/DNS blocklists.
- Leader — Skip
- Engineer — Learn: Novel abuse of unpkg CDN as free phishing infrastructure — developers who install the packages are not the target, but this technique shows how legitimate CDN reputation can carry malicious payloads. Worth factoring into proxy/WAF policy reviews for unpkg.com egress.
- SOC/IR — Plan: ClickFix-style fake CAPTCHA pages hosted on unpkg.com may bypass domain-reputation filters; build or tune proxy detections for unpkg.com redirects to non-package HTML content and correlate with clipboard-execution behaviors downstream.
- Leader — Skip
- Engineer — Act: Active supply-chain compromise in npm packages is an Act signal regardless of KEV status — audit your dependency tree immediately for these 14 packages masquerading as calendar/streak utilities and check CI build logs for processes spawned by node_modules executing detached binaries.
- SOC/IR — Plan: The implant’s load behavior — extracting a bundled binary, chmod-ing it, and launching it as a detached process — is a detectable Linux TTP; build or tune EDR rules to alert on node/npm processes spawning unexpected child executables, but the summary lacks IOCs or package names needed to hunt right now.
- Leader — Plan: An active npm supply-chain campaign using AI-assisted C2 signals an escalating threat class; this quarter, direct engineering to verify SCA tooling covers npm and confirm your CI pipelines would catch a malicious package load before it reaches production.
- Engineer — Act: Active typosquatting campaign at scale on npm means any Node.js project is at risk right now. Audit recent npm installs against known-malicious package lists, review package-lock.json for suspicious names, and scan CI/CD build logs for unexpected packages installed in the last 30 days.
- SOC/IR — Plan: RAT plus infostealer payloads imply C2 beaconing and credential exfil as post-infection behavior; no specific IOCs are available yet. Build or tune detections for anomalous outbound connections from developer workstations and CI/CD runners, and alert on npm install activity pulling packages with low download counts or AI-generated-looking names.
- Leader — Learn: An 800-package campaign illustrates the ongoing systemic risk of open-source registry abuse; useful framing for software composition analysis (SCA) tooling and SBOM investment conversations, but no immediate leadership action is indicated unless internal teams confirm a compromised dependency.
- Engineer — Act: A self-propagating npm worm targeting GitHub Actions runner secrets is a direct threat to any CI/CD pipeline using npm packages; audit your runner logs for unexpected outbound calls to Ethereum RPC endpoints and review recently installed or updated npm dependencies for malicious scripts.
- SOC/IR — Plan: The blockchain-based C2 technique (Ethereum smart contracts for routing) is a novel evasion method worth building detections for; develop hunt queries for unusual npm postinstall script execution and outbound connections to Ethereum JSON-RPC endpoints from CI runners.
- Leader — Learn: This campaign illustrates how supply chain attacks are adopting decentralized infrastructure to evade takedowns — relevant context for board-level discussions on software supply chain risk and CI/CD security investment.
- Engineer — Act: Active supply-chain compromise in the npm keyv/cacheable packages — audit all build hosts for execution of these packages immediately and preserve forensic state before touching credentials, because revoking the stolen token is what triggers the malicious payload; follow a forensics-first sequence before any rotation.
- SOC/IR — Act: Ongoing supply-chain worm with a novel IR wrinkle: token revocation activates the payload, which inverts standard response playbooks — sweep CI/CD build logs for keyv/cacheable execution since Aug 4, and update incident runbooks to gate credential rotation on payload-trigger analysis.
- Leader — Plan: Active npm supply-chain compromise affecting keyv/cacheable; confirm whether internal engineering teams depend on these packages and brief engineering leadership on the non-standard response sequence before teams instinctively rotate credentials and worsen the incident.
- Engineer — Act: Audit your full dependency tree immediately for any of the ~79–353 poisoned package names; packages downloaded since August 4 may contain credential-stealing code and rogue VS Code/Claude Code hooks. Rotate any secrets accessible from affected build environments and re-run CI pipelines from clean, verified dependency locks.
- SOC/IR — Act: Hunt for anomalous outbound connections and credential-use anomalies from developer workstations and CI/CD runners since August 4, 2026; also sweep for unexpected VS Code extension modifications or Claude Code hook installations that could indicate a compromised dev environment.
- Leader — Act: This is a systemic npm supply-chain event touching 868+ package versions—brief engineering leadership now, confirm whether any internal products or pipelines depend on keyv or Cacheable-namespace packages, and request an exposure report before the week ends.
- Engineer — Act: A self-propagating worm across 400+ npm packages directly threatens any JavaScript/Node.js dependency tree; audit all npm dependencies against the compromised package list in the Microsoft post, inspect CI/CD build logs for IOCs, and rotate any credentials present in affected build environments.
- SOC/IR — Act: Microsoft’s write-up includes attack chain details and explicit detection and hunting guidance; run hunts for the described IOCs in pipeline and build-system logs and tune detections for the self-republishing propagation behavior since 2026-08-04.
- Leader — Act: 400+ compromised npm packages is a systemic supply chain event comparable in breadth to prior ecosystem-wide incidents; this week confirm whether internal or third-party software uses affected packages and prepare a brief for leadership in case customers or the board surface questions.
- Engineer — Act: With 1,300+ compromised packages and 2 billion monthly downloads, your dependency tree almost certainly has exposure. Audit your package-lock.json and container build logs for ChainDrop-infected packages immediately, pin dependency versions, and check CI artifact outputs for signs of malicious code injection.
- SOC/IR — Act: A self-propagating npm compromise at this scale warrants an immediate assume-breach sweep of CI/CD pipelines and developer endpoints; hunt for anomalous outbound connections or unexpected code execution originating from build environments since packages may have already run in your estate.
- Leader — Act: The breadth of this event (2 billion combined monthly downloads) makes it a likely board-level question; task engineering to confirm exposure in your dependency tree and assess whether any customer-facing or production artifacts were built with compromised packages, then brief leadership before it surfaces in the news.
- Engineer — Plan: Audit your npm dependency tree for any package named ’lib-mtop’ or other scoped/unscoped Alibaba-adjacent packages; add registry scoping rules or lockfile scrutiny to your CI pipeline to catch namespace-confusion attacks before they land.
- SOC/IR — Learn: No IOCs or ATT&CK mappings are provided in the enrichment signals; file this as context on namespace-confusion supply-chain TTPs and revisit if indicators emerge.
- Leader — Skip
- Engineer — Act: Supply-chain compromise with import-time execution is an immediate threat to any project pulling these beta versions; audit node_modules and lockfiles for @joyfill/layouts@0.1.2-2773.beta.0 and @joyfill/components@4.0.0-rc24-2773-beta.4, remove them, and inspect CI/CD build artifacts from affected hosts for signs of RAT persistence.
- SOC/IR — Act: The DEV#POPPER malware family has prior campaign IOCs — hunt for outbound connections and process spawns originating from npm install/build steps on developer workstations and CI runners; prioritize any host that ran builds pulling @joyfill packages since these beta versions were published.
- Leader — Plan: Confirm whether engineering teams use @joyfill beta packages and use this incident to validate that npm supply chain controls — lockfiles, dependency auditing, and private registry mirroring — are enforced across your development pipeline this quarter.
- Engineer — Act: Supply chain compromise targeting a widely-used frontend toolchain is a direct risk to any team using Vite or related npm packages; audit your dependency tree immediately for the seven ViteVenom packages and inspect CI/CD build logs for unexpected outbound connections to Tron blockchain endpoints.
- SOC/IR — Plan: The four-tier blockchain-based C2 using Tron is a novel evasion technique worth building detections for; develop hunt logic to flag anomalous blockchain API calls originating from build runners or developer workstations, and add this TTP to your supply-chain detection backlog.
- Leader — Learn: This campaign illustrates how adversaries are embedding resilient, blockchain-routed C2 in developer tooling supply chains; worth referencing in future discussions about secure software development lifecycle risk and third-party dependency governance.
- Engineer — Learn: The updated analysis covers wormable malware patterns, CI/CD persistence techniques, and multi-stage npm attack chains — useful for hardening your pipeline and package vetting posture, but no specific package compromise or KEV signal requiring immediate action today.
- SOC/IR — Learn: The breakdown of npm attack TTPs (worm propagation, CI/CD persistence) helps tune detection logic for build pipeline anomalies, but no concrete IOCs or active campaign indicators are surfaced in this item.
- Leader — Skip
- Engineer — Act: Confirmed supply chain compromise of AsyncAPI npm packages with import-time malware execution — audit all projects for AsyncAPI dependencies, check CI/CD build logs for the affected package versions, and rotate any secrets accessible from compromised build environments.
- SOC/IR — Act: Active campaign with malware delivered at import time via npm means CI/CD runner telemetry is the primary hunt surface — sweep build system logs for suspicious outbound connections or process spawns during npm install/import phases since the compromise window, and tune EDR rules to flag unusual child processes from package managers.
- Leader — Act: A weaponized CI/CD supply chain attack of this type can expose credentials and intellectual property across every project that consumed the affected packages — confirm internally whether AsyncAPI packages are in use, request an exposure assessment from engineering, and prepare to brief leadership given the potential scope.
- Engineer — Act: Active supply-chain compromise with four named @asyncapi package versions confirmed by four independent security firms. Audit lockfiles and dependency manifests for @asyncapi/generator-helpers@1.1.1, @asyncapi/generator-components@0.7.1, @asyncapi/generator@3.3.1, and @asyncapi/specs v6.11.2/v6.11.2-alpha.1; pin to clean versions and re-run any build that pulled these.
- SOC/IR — Act: Multi-stage botnet loader distributed through CI/CD dependency chains means build infrastructure and developer machines are the compromise surface. Hunt for these specific package versions in npm install logs and artifact registries, and look for anomalous outbound connections from build runners or developer endpoints since the compromised versions’ publish dates.
- Leader — Plan: Corroborated supply-chain compromise in a popular API-tooling namespace warrants directing engineering to complete a dependency audit this week; if these packages appear in shipped products, assess whether customer disclosure or SBOM updates are required under existing contractual or regulatory obligations.
- Engineer — Act: Audit all projects and CI/CD pipelines for the malicious Jscrambler npm version; if found, treat the build environment as compromised and rotate any credentials or tokens accessible during that build.
- SOC/IR — Act: Search CI/CD and build system logs for installations of the malicious Jscrambler package, then hunt for infostealer exfiltration activity (credential theft, unexpected outbound connections) on any hosts where it executed.
- Leader — Plan: A supply-chain attack on a security vendor’s npm package (~1,500 downloads) underscores third-party software risk; confirm whether your org consumes Jscrambler’s npm package and, if so, request their incident timeline and impact report.
- Engineer — Learn: Novel abuse of npm as free hosting infrastructure to serve malicious browser-side JavaScript to site visitors rather than targeting package consumers directly; review whether your org hosts any user-facing content via npm and revisit supply-chain threat models to include registry-as-CDN attack patterns.
- SOC/IR — Learn: No IOCs or ATT&CK-mapped TTPs are published from this research, so there is nothing actionable to hunt or detect today; file as a reference technique — browser-based DDoS recruited via malicious proxy sites — for future detection engineering when lure sites targeting your sector emerge.
- Leader — Skip
- Engineer — Act: A preinstall hook in jscrambler 8.14.0 drops and executes a cross-platform native infostealer — this is live supply-chain compromise. Audit all CI/CD pipelines and developer machines for installs of this exact version, remove or pin away from 8.14.0, and treat any affected environment as potentially credential-compromised.
- SOC/IR — Act: Hunt for jscrambler 8.14.0 installs in npm audit logs, CI runner job histories, and artifact caches since July 11, 2026; on affected endpoints look for unexpected native binary drops or executions spawned from the npm install process, as infostealer data exfiltration may have already occurred.
- Leader — Act: Confirm this week whether jscrambler 8.14.0 reached any company build pipeline or developer workstation; if so, treat as a credential-theft incident — initiate credential rotation and brief relevant stakeholders, since infostealers harvest tokens, SSH keys, and secrets stored on the machine.
- Engineer — Act: Confirmed supply-chain attack: audit all dependency trees and package-lock files for @injectivelabs/sdk-ts@1.20.21; if found in any build artifact or runtime environment, treat wallet private keys and seed phrases as compromised and rotate immediately.
- SOC/IR — Act: Sweep CI/CD build logs, container image layers, and package manifests across all repositories for @injectivelabs/sdk-ts version 1.20.21; any positive hit should trigger an incident investigation for outbound exfiltration from build environments.
- Leader — Learn: A confirmed GitHub-to-npm supply-chain attack targeting crypto wallet credentials; worth referencing in supply-chain security policy discussions, and escalate to Act if the organization has products or vendors with Web3/DeFi dependencies.