Loading story…
Researchers uncovered a coordinated software supply chain attack involving 36 malicious npm packages masquerading as Strapi CMS plugins. Uploaded from four sockpuppet accounts over roughly 13 hours, the packages abused postinstall scripts to run automatically during installation and delivered multiple payload variants that performed reconnaissance, searched filesystems for secrets, stole credentials, opened reverse shells, and attempted exploitation of Redis and PostgreSQL. Investigators said the campaign evolved from aggressive Redis RCE and Docker escape attempts to quieter persistence and data theft, with some payloads using hard-coded credentials, a host reference to prod-strapi, and outbound communications to attacker infrastructure including 144[.]31[.]107[.]231.
The activity appears to have been highly targeted at a cryptocurrency-related payment environment, with reporting linking the operation to infrastructure associated with Guardarian and noting attacker interest in digital asset data. Later-stage payloads deployed a persistent implant such as .node_gc.js or used fileless execution via detached Node.js processes while exfiltrating .env files, private keys, Redis dumps, Docker secrets, and Kubernetes tokens over plaintext HTTP. Defenders were urged to remove the malicious packages, rotate exposed credentials, revoke Kubernetes service account tokens, inspect cron jobs and upload directories for persistence, and terminate any connections to the attacker-controlled infrastructure.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
Public reporting revealed that 36 malicious npm packages had been used to steal secrets, exploit Redis and PostgreSQL, attempt container escape, and establish persistent command-and-control access. The disclosure included indicators such as attacker IP 144.31.107.231 and guidance to remove the packages, rotate credentials, revoke Kubernetes tokens, and inspect persistence mechanisms.
Researchers found an open directory on the campaign's C2 server that exposed source code, exploit tools, credential-stuffing utilities, and an 8.8 MB exfiltration log. The recovered data showed active compromise of at least 14 victim containers, including Guardarian, with stolen production Strapi secrets, database credentials, JWT/admin secrets, and third-party API keys.
Analysis of hard-coded credentials, a specific hostname such as prod-strapi, and interest in digital asset-related data led researchers to assess the operation as a targeted attack. Reporting associated the likely victim environment with the cryptocurrency payment platform Guardarian.
SafeDep identified the malicious activity on April 3, 2026, after observing suspicious behavior from the package strapi-plugin-events, including filesystem-wide secret searches and outbound traffic to attacker-controlled infrastructure. The investigation linked the packages to exploitation of Redis and PostgreSQL and exfiltration of sensitive data.
The campaign progressed through at least eight payload variants, shifting from aggressive Redis remote code execution and Docker escape attempts to reconnaissance, hard-coded database access, credential theft, and persistence. Later versions deployed a persistent implant such as .node_gc.js or used detached fileless node -e execution.
Over a 13-hour period, attackers used four sockpuppet npm accounts to publish 36 malicious packages that mimicked legitimate Strapi CMS plugin names. The packages were designed to run automatically via postinstall scripts during npm installation.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 11 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
5 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourcecybersecuritynews.com
Open sourcethehackernews.com
Open sourceintel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026