Loading story…
Cybersecurity researchers have uncovered a coordinated campaign in which malicious packages distributed through popular open-source repositories—npm, PyPI, and RubyGems—are being used to exfiltrate sensitive developer data using Discord webhooks as a command-and-control (C2) channel. Attackers have published several packages, such as mysql-dumpdiscord and nodejs.discord on npm, as well as malinssx, malicus, and maliinn on PyPI, and sqlcommenter_rails on RubyGems, which are designed to steal configuration files, environment variables, and host information from developer systems. These packages leverage Discord webhooks, which allow data to be sent directly to attacker-controlled Discord channels without requiring authentication or bot users, making detection and mitigation more challenging. The use of Discord webhooks is particularly insidious because webhook URLs are write-only, preventing defenders from easily auditing what data has been exfiltrated. In some cases, the malicious code is triggered during package installation, such as with 'pip install' commands, enabling the theft of sensitive information before runtime monitoring can detect the activity. The stolen data includes critical files like config.json, .env, ayarlar.js, ayarlar.json, and even system files such as '/etc/passwd' and '/etc/resolv.conf', which may contain credentials, API keys, and other secrets. By abusing Discord’s infrastructure, attackers avoid the costs and risks associated with maintaining their own C2 servers, and their traffic often blends in with legitimate communications, bypassing many firewall and monitoring solutions. The campaign highlights the ongoing risks associated with software supply chain attacks, where threat actors target developers and CI/CD environments by injecting malicious code into widely used open-source packages. Security experts warn that such attacks can have far-reaching consequences, as compromised developer machines and build systems may inadvertently propagate stolen secrets or further malicious code into downstream applications. The discovery underscores the importance of rigorous package vetting, monitoring for suspicious network activity, and the use of security tools that can detect anomalous behavior during package installation. Researchers emphasize that the abuse of Discord webhooks for C2 is a growing trend, as it offers attackers a free, scalable, and stealthy method for data exfiltration. The incident serves as a reminder for organizations to review their dependency management practices and to educate developers about the risks of installing untrusted packages. The affected repositories have been notified, and some of the malicious packages have been removed, but the ease of publishing new packages means the threat remains ongoing. This campaign demonstrates the evolving tactics of threat actors in targeting the software supply chain and the need for continuous vigilance in the open-source ecosystem. Organizations are advised to implement automated scanning of dependencies and to restrict outbound network connections from build environments where possible. The use of Discord as a C2 channel is expected to persist, given its accessibility and the difficulty of monitoring webhook-based exfiltration. Security teams should update detection rules to flag unexpected communications with Discord domains, especially from development and CI/CD systems. The incident also highlights the broader challenge of securing open-source software, where trust in package maintainers and repositories is critical but increasingly under attack.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
Researchers also reported that the North Korean-linked 'Contagious Interview' campaign had seeded 338 malicious npm packages targeting Web3, cryptocurrency, and blockchain developers. The packages, downloaded more than 50,000 times, were used to deliver BeaverTail and InvisibleFerret malware and harvest credentials and wallet data.
Security researchers discovered multiple malicious packages across npm, PyPI, and RubyGems that used Discord webhooks as command-and-control channels to steal developer data, including configuration files, host information, and credentials. Reported package examples included mysql-dumpdiscord, malinssx, and sqlcommenter_rails.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcesecurityonline.info
Open sourcethehackernews.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A series of sophisticated supply chain attacks have targeted the NPM ecosystem, compromising both widely used and niche packages to deliver malicious payloads. The "Shai-Hulud" campaign has infected at least 187 NPM packages, including the highly popular tinycolor package, which receives approximately 2 million downloads weekly. Attackers in this campaign modify package manifests, inject malicious files, and republish the compromised packages, resulting in downstream projects unknowingly incorporating malicious code. The worm-like nature of the attack allows it to spread rapidly to other maintainers' packages, amplifying the impact across the software supply chain. Delayed detection of these compromises increases the risk, as many projects may already be affected before the breach is discovered. The attack highlights the critical importance of verifying package signatures and maintaining a robust software bill of materials (SBOM) to trace dependencies and versions accurately. In a related but distinct campaign, a threat actor using the NPM account "ongtrieuhau861.001" has published at least 94 malicious packages, many of which are specifically crafted to target Asian banks. These packages, often named with the pattern "dhhdbankxxxxx" and similar variants, deliver a JavaScript-based Remote Access Trojan (RAT) dubbed "DHSollutionsBot." This RAT leverages Firebase Realtime Database for command and control, while exfiltrating stolen data through Discord webhooks, making detection more challenging due to the use of legitimate cloud services. The threat actor's NPM account history suggests either a long-term operation or the acquisition of an existing account for malicious purposes. The attack architecture is notable for its simplicity and effectiveness, combining two legitimate platforms for resilient and stealthy C2 operations. Both campaigns underscore the growing threat of supply chain attacks in the open-source ecosystem, where a single compromised package can have cascading effects on countless downstream projects. Developers and organizations are urged to implement cryptographic signing of packages, verify signatures before use, and maintain detailed SBOMs to mitigate the risk of such attacks. The incidents also demonstrate the need for continuous monitoring of package repositories and automated detection tools to identify and respond to malicious activity promptly. The use of trusted platforms like Discord and Firebase for C2 communications further complicates detection and response efforts. These attacks serve as a stark reminder that even well-established codebases can become vectors for compromise if their dependencies are not rigorously vetted and monitored. The campaigns have prompted renewed calls for improved security practices in the software development lifecycle, particularly in the management of third-party dependencies. Organizations are advised to review their exposure to affected NPM packages and take immediate remediation steps where necessary. The incidents highlight the evolving tactics of threat actors in targeting the software supply chain and the critical need for industry-wide vigilance.
Jul 12, 2026
A large-scale supply chain attack has targeted the Node Package Manager (NPM) ecosystem, compromising hundreds of widely used JavaScript packages and threatening the security of software development pipelines globally. In mid-September, cybersecurity researchers identified a self-propagating malware dubbed "Shai-Hulud," which was distributed through trojanized NPM packages, including some with millions of weekly downloads and high-profile packages such as those from CrowdStrike. The attack leveraged a malicious "bundle.js" script that downloaded and executed TruffleHog, a legitimate credential scanner, to harvest developer and CI/CD tokens, cloud service credentials, and environment variables from compromised systems. The stolen credentials were exfiltrated via hard-coded webhooks and GitHub Actions workflows, enabling the attacker to further propagate the malware and gain unauthorized access to sensitive resources. The campaign affected both Windows and Linux systems, increasing its reach and impact across diverse development environments. Sysdig reported that the attack on September 15 involved approximately 200 compromised packages, including @ctrl/tinycolor, and was linked to an attacker who had previously targeted Nx packages in late August. The worm not only stole secrets but also published them publicly on GitHub and attempted to make victim repositories public, amplifying the risk of further compromise. Earlier in the month, other popular packages such as chalk, debug, and duck were also compromised following a successful spear phishing attack against a maintainer, with the attacker seeking to redirect cryptocurrency payments. NPM responded by removing the malicious package versions, but users were required to update or revert to secure versions to mitigate the risk. Sysdig provided same-day threat intelligence and detection capabilities to its customers, including open source Falco rules to identify and respond to the threat. The attack demonstrated the vulnerability of even the most trusted and widely used open source packages, highlighting the importance of continuous monitoring and rapid response in the software supply chain. Security researchers and vendors emphasized the need for organizations to scan their environments for known malicious packages, such as dist.fezbox.cjs, and to review logs for signs of credential exfiltration. The incident underscored the evolving tactics of threat actors targeting developer ecosystems, using advanced techniques to automate propagation and maximize impact. Organizations relying on NPM packages and CI/CD pipelines were urged to remain vigilant, update dependencies promptly, and leverage threat intelligence resources to defend against similar attacks. The Shai-Hulud campaign remains an evolving threat, with ongoing analysis and mitigation efforts by the security community. This incident serves as a stark reminder that popularity and trust in open source packages do not guarantee safety, and proactive security measures are essential to protect software supply chains from compromise.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026