Loading story…
A malicious npm package named fezbox was published to npm in August 2025 and remained available for 32 days before npm seized it in September. Investigators found that versions 1.0.0 through 1.3.0 used a postinstall payload with a 120-second delay and environment checks, then retrieved a QR code from Huawei Cloud infrastructure and decoded it into Base64-encoded JavaScript. The payload was designed to steal browser cookies, origin, and user-agent data and exfiltrate host reconnaissance to attacker-controlled endpoints, including an unauthenticated /collect endpoint and a secondary Railway.app service used for structured credential collection.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-03, Breakglass assessed the operation as likely run by a China-based low-to-medium sophistication actor. The assessment was based on Huawei Cloud hosting in Beijing, China Mobile source IP usage, Chinese-locale artifacts, and the operator's poor operational security.
By 2026-04-03, researchers reported that the Huawei Cloud server at 1.94.210.59 remained online with unauthenticated endpoints such as /collect and /data. Analysis linked the infrastructure to fezbox and a QR-code-delivered browser cookie stealer, with four exposed exfiltration records visible.
npm security removed or seized the malicious fezbox package on 2025-09-22, ending its availability after 32 days on the registry. No confirmed third-party victim data was identified in the exposed primary database at the time described by investigators.
Exposed exfiltration records showed multiple apparent self-test submissions from the operator's own machine rather than confirmed external victims. The data included hostname, username, OS, hardware, working directory, and an IP linked to China Mobile in Nanjing, Jiangsu Province, China.
For 32 days after publication, fezbox remained available on npm and reached up to 476 downloads while communicating with Huawei Cloud-hosted infrastructure. The malware performed host reconnaissance, delayed execution, fetched a QR code containing Base64-encoded JavaScript, and attempted to exfiltrate data to unauthenticated endpoints.
The malicious npm package fezbox was published on npm on 2025-08-21. Versions 1.0.0 through 1.3.0 used a postinstall mechanism tied to attacker-controlled infrastructure and QR-code-delivered JavaScript.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
3 references tracked. Mallory keeps watching after this page renders.
intel.breakglass.tech
Open sourceintel.breakglass.tech
Open sourcenpmjs.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across **Windows via WSL, macOS, and Linux**, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a **WebSocket-based reverse shell**. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to `216.126.225.243` over ports `8085`, `8086`, and `8087`, and included host profiling plus an `HMAC-SHA256` routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with **DPRK-linked OtterCookie** infrastructure. In a separate incident, Socket Threat Research said the widely used npm package **`art-template`** was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions **`4.13.5`** and **`4.13.6`**. The injected code redirected users to a watering-hole framework at `utaq.cfww.shop` that selectively targeted **Safari on iOS 11.0 through 17.2**, beaconed device and IP data to `l1ewsu3yjkqeroy.xyz`, and used anti-bot checks, anti-headless logic, and **WebAssembly-based fingerprinting** before retrieving gated payloads. Researchers found strong overlap with the **Coruna exploit kit**, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at **iOS 17.3**, with additional similarities noted to **UNC6691**.
Jun 29, 2026
Researchers disclosed a campaign using **24 malicious npm packages** as phishing infrastructure, abusing package CDN mirrors such as **unpkg** to publish a single HTML file that renders a fake **Cloudflare CAPTCHA** page. Instead of targeting developers through dependency compromise or malware-laced code, the packages were designed to exploit the trust and availability of npm mirror services, giving attackers a seemingly legitimate hosting channel for phishing content. The operation reportedly evolved after an earlier **Microsoft-themed typosquatted domain** was blocked by Google Chrome Safe Browsing, with the attackers shifting to **KeyVal** as a dead-drop resolver to control redirection targets. Researchers said the current lure redirects users to the legitimate **ChatGPT** website, but warned the same infrastructure can be quickly repointed to **ClickFix-style phishing** pages or malware delivery sites, turning public package mirrors into flexible staging points for social-engineering attacks.
Aug 27, 2026
The npm package **jscrambler** was compromised through malicious version `8.14.0`, which added an undocumented `preinstall` hook and install-time files that executed hidden native binaries on **Windows, macOS, and Linux** during `npm install`, before application code ran. Researchers said the release appeared to be published directly to npm from a legitimate maintainer account without matching source repository commits or tags, pointing to a likely compromise of the maintainer account or build pipeline. Socket reported detecting the release within minutes of publication and alerted the maintainers, while a subsequent `8.15.0` release appeared clean. Further analysis linked the package to a **Rust-based infostealer** aimed at developer workstations and CI/build environments, creating exposure for source code, environment variables, build credentials, deployment tokens, and other secrets. Reported targets included cloud credentials, browser data, messaging sessions, cryptocurrency wallets, Bitwarden vault contents, and configuration files for AI coding tools such as **Claude Desktop, Cursor, Windsurf, VS Code, and Zed**. Researchers also observed anti-debugging on Windows and macOS, Linux `eBPF` capability, persistence through Windows scheduled tasks and macOS LaunchAgents, and encrypted command-and-control details; because `8.14.0` remained available on npm, pinned installs on older npm clients that still run install scripts could continue to trigger the payload.
Jul 18, 2026