Malicious open-source packages and developer-targeted supply chain attacks

Security researchers reported multiple software supply chain threats targeting developers via public package ecosystems. Tenable analyzed a malicious npm package, ambar-src, that reached roughly 50,000 downloads in days before removal; it executed during installation via malicious preinstall behavior, used evasion techniques, and dropped OS-specific payloads for Windows, Linux, and macOS, with typosquatting assessed as the likely lure (mimicking ember-source). Separate reporting described a campaign using malicious NuGet packages (e.g., NCryptYo, DOMOAuth2_, IRAOAuth2.0, SimpleWriter_) that impersonated legitimate .NET libraries, executed code on assembly load, and established local proxying/backdoor behavior to facilitate credential theft and persistence in ASP.NET environments.

Additional coverage warned of an npm “worm-like” propagation pattern impacting CI pipelines and AI coding tools, reinforcing that developer tooling and build systems are high-risk choke points where a single poisoned dependency can spread quickly across environments. While the broader set of articles also included unrelated breach, ransomware, and policy items, the developer-focused supply chain reporting consistently emphasized that installation-time execution and typosquatting/impersonation enable compromise even when developers never directly call the malicious code, and that traditional detection can lag (e.g., low initial antivirus detection rates for obfuscated .NET payloads).