Loading story…
SafeDep reported a malicious npm supply-chain campaign involving nodemon-sudo v3.1.16 and its dependency tslint-conf v7.2.1, published by the npm account conodeeth. The package impersonated the legitimate nodemon tool but contained no obvious malicious install hook or import-time payload. Instead, nodemon-sudo pulled in tslint-conf, a repackaged copy of the pino logger that hid a backdoor designed to evade common package screening and static detection.
The backdoor activated only when the exported logger-style function was executed at runtime, spawning a detached Node.js process that retrieved a second-stage payload from a Pinata IPFS gateway and executed it with the real require function, enabling remote code execution. SafeDep linked the activity to earlier nodemon-node and ts-await packages through shared infrastructure and matching code, while cautioning that any North Korea nexus remains unconfirmed and based only on tradecraft similarities. Defenders were advised to treat systems that installed nodemon-sudo or tslint-conf as compromised, remove the packages, rotate credentials, and investigate outbound connections to associated Pinata and jsonkeeper infrastructure.
Trace attribution and downstream blast radius.
2 events from the most recent confirmed update back to the earliest known activity.
According to SafeDep, the npm account conodeeth published nodemon-sudo v3.1.16 and its dependency tslint-conf v7.2.1 on npm. The packages were part of a supply-chain campaign in which nodemon-sudo impersonated the legitimate nodemon package and relied on a backdoored dependency for execution.
SafeDep reported that nodemon-sudo itself contained no install script and no directly malicious code, but pulled in a repackaged pino logger via tslint-conf that fetched a second-stage payload from a Pinata IPFS gateway and executed it at runtime. The report also linked the campaign to earlier packages nodemon-node and ts-await through shared infrastructure and identical backdoor code, while noting attribution to a North Korea-linked cluster was unconfirmed.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 13 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026
SafeDep identified a malicious npm supply-chain campaign that hid the `ulid-xyz` remote-access trojan three levels deep in a dependency chain. The operation used `ioredis-xyz`, a near-copy of the legitimate `ioredis` client, which depended on the nonfunctional relay package `redis-type-xyz`; version `1.10.6` of that relay then introduced `ulid-xyz` within a permissive version range. The payload's malicious `postinstall` hook established WebSocket command-and-control, conducted host and filesystem reconnaissance, accepted operator-provided binaries, and persisted as `MicrosoftSystem64` across Windows, macOS, and Linux. npm removed `ulid-xyz` on August 25, 2026. Infrastructure and operational overlaps—including port `8010`, Hetzner-hosted infrastructure, shared persistence naming, and repository ownership—provide moderate-to-strong circumstantial links to the DPRK-linked **FAMOUS CHOLLIMA** / Contagious Interview cluster. No second-stage payload was found in the analyzed package archives, and the public attribution remains unconfirmed; however, organizations using the affected dependency chain should audit lockfiles and build artifacts for `ioredis-xyz`, `redis-type-xyz`, and `ulid-xyz`, and investigate systems for the `MicrosoftSystem64` persistence artifact and unexpected WebSocket traffic.
Sep 2, 2026
Several GitHub-hosted JavaScript projects were modified to include a malicious `postinstall` entry in `package.json`, turning routine dependency installation into unauthorized code execution. Commits affecting repositories including **thedevdojo/genesis**, **katanaui/katana**, and **baskarcm/tzi-chat-ui** added a script that used `curl` with certificate checks disabled to fetch a binary named `gvfsd-network` from a GitHub Releases page tied to `parikhpreyash4/systemd-network-helper-aa5c751f`, save it as `/tmp/.sshd`, mark it executable, and run it in the background. The pattern indicates a supply-chain style compromise designed to hide a backdoor inside otherwise ordinary dependency or build changes. Other repositories moved quickly to remove the payload, with commits in **elitedevsquad/sidecar-laravel** and **katanaui/katana** explicitly reverting the suspicious `postinstall` logic while preserving legitimate build scripts. The repeated use of the same download URL, filename, and execution flow across unrelated projects suggests a coordinated campaign rather than isolated developer error. Separately, CISA added **CVE-2026-48172** in the **LiteSpeed cPanel Plugin** to its Known Exploited Vulnerabilities catalog, but the dominant event across the referenced code changes was the discovery and rollback of a malicious package-install backdoor hosted through GitHub infrastructure.
Jun 29, 2026