Loading story…
The Open Source Security Foundation warned that attackers are actively targeting open source developers, particularly Node.js and npm maintainers, with social engineering campaigns delivered through Slack, LinkedIn, Microsoft Teams, and fake Google Workspace pages. The activity mirrors the earlier compromise of an Axios maintainer, in which operators linked to North Korea allegedly used a fake Slack workspace, a cloned company identity, and a staged Teams call to trick the victim into installing a remote access trojan disguised as a software update, then used that access to push malware into npm packages with more than 100 million weekly downloads.
New reports say the campaign now includes impersonation of a Linux Foundation community leader and malicious links sent into open source communities including ToDoGroup. OpenSSF said the fake Google Workspace flow is designed to steal credentials and verification codes and may prompt victims to install a fraudulent root certificate, enabling interception of encrypted traffic; Mac users may also receive an additional malicious binary that can lead to full system compromise. Security researchers and mailing list participants said the incidents highlight how attackers exploit trust on centralized collaboration platforms, and urged maintainers to verify identities through separate channels and treat any system, session, token, or credential exposed to the lures as compromised.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Open Source Security Foundation CTO Christopher Robinson warned that attackers are actively targeting open source developers, especially Node.js and npm maintainers, with social-engineering attacks. The advisory said victims are sent to a fake Google Workspace page that steals credentials and verification codes and may prompt installation of a fake root certificate and a malicious Mac binary, enabling traffic interception, credential theft, and possible full system compromise.
In a reported incident discussed on oss-sec and cited by OpenSSF, an attacker impersonated a well-known Linux Foundation community leader and attempted to lure a victim to a malicious link through Slack, including in communities such as ToDoGroup. The campaign was described as active and part of a wider pattern of abuse across collaboration platforms.
Researchers at Socket reported that the same broader campaign also targeted multiple prominent open source maintainers and Socket personnel through LinkedIn or Slack messages posing as recruiters, company representatives, or podcast hosts. The activity showed the campaign extended beyond a single maintainer compromise.
In the earlier Axios incident referenced by the advisory, attackers allegedly used a fake Slack workspace, a cloned company identity, and a fabricated Microsoft Teams call to trick a maintainer into installing a remote access trojan disguised as a software update. They then used that access to inject malware into npm packages with more than 100 million weekly downloads.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
go.theregister.com
Open sourcescworld.com
Open sourcecybersecuritynews.com
Open sourcehelpnetsecurity.com
Open sourceseclists.org
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers have uncovered multiple campaigns involving malicious npm packages designed to steal developer credentials and sensitive information from Windows, macOS, and Linux systems. In one operation, ten typosquatted packages impersonated popular libraries such as TypeScript, discord.js, ethers.js, and others, using sophisticated obfuscation, fake CAPTCHA prompts, and postinstall hooks to deploy an information stealer that harvested credentials from system keyrings, browsers, and authentication services. The malware executed in a new terminal window to evade detection and sent stolen data, including IP addresses, to external servers. Another large-scale campaign, dubbed 'PhantomRaven,' involved 126 npm packages and over 86,000 downloads, targeting authentication tokens, CI/CD secrets, and GitHub credentials. These packages leveraged remote dynamic dependencies to fetch and execute payloads during installation, profiling infected devices and exfiltrating secrets for potential supply chain attacks. The attackers employed techniques such as slopsquatting, where AI-generated package recommendations led developers to install non-existent, malicious packages. Some packages impersonated tools from GitLab and Apache, and many remained available on npm at the time of reporting. The campaigns highlight the ongoing risks in the npm ecosystem, with attackers exploiting both user trust and platform weaknesses to compromise developer environments and CI/CD pipelines. Security experts warn that the theft of tokens and credentials could enable further attacks, including the introduction of malicious code into legitimate projects and broader supply chain compromises.
Jun 29, 2026
Attackers are increasingly abusing trusted enterprise collaboration platforms including **Microsoft Teams, Slack, and Google Meet** to steal credentials, impersonate employees, deliver malware, and maintain post-compromise access. Palo Alto Networks Unit 42 reported that alerts tied to malicious activity on collaboration tools increased more than fourfold over the past year, with **99%** of those alerts linked to chat-based phishing. The activity reflects a shift from obviously malicious infrastructure to legitimate communication channels that users and defenders often trust by default. Documented cases include **APT29** phishing through Microsoft Teams, adversary-in-the-middle credential theft using attacker-controlled Slack workspaces, the **Contagious Interview** campaign themed around Fireblocks, the compromise of an **Axios npm** maintainer, Slack phishing reported by **OpenSSF** against Linux Foundation communities, and **CERT Polska** findings on Slack webhook abuse for persistence and credential exfiltration. Researchers said collaboration platforms now form part of the enterprise identity attack surface and urged organizations to tighten guest and federation controls, enforce stronger identity protections, verify sensitive requests through secondary channels, and correlate collaboration, endpoint, and network telemetry in monitoring and incident response.
Aug 31, 2026
Security researchers reported a coordinated campaign targeting high-impact **Node.js** and **npm** maintainers through social engineering, with the activity described as focused on influential open-source developers whose accounts or packages could provide broad downstream access. Public reporting tied the operation to attempts to compromise trusted maintainers in the JavaScript ecosystem, including references to widely used projects such as **Axios**, raising concern over software supply chain exposure if attacker access were obtained. Separate reporting also tracked an **OtterCookie** infostealer campaign operating across **npm**, linking the malware activity to the same broader threat context and associating it with **DPRK**-aligned tradecraft. The combined reporting indicates an effort to use maintainer targeting and malicious npm activity to steal credentials, compromise developer environments, and potentially abuse trusted package distribution channels for follow-on supply chain attacks.
Jul 1, 2026