Loading story…
Compromised releases of the widely used ua-parser-js npm package distributed malicious code after an attacker gained access to the maintainer’s npm publishing account or keys. The tainted versions — 0.7.29, 0.8.0, and 1.0.0 — were briefly published as the latest releases and executed a preinstall script that downloaded and ran malware from attacker-controlled infrastructure, including 159.148.186[.]228 and citationsherbe[.]at. Reports said the payload installed cryptocurrency-mining malware on Windows and Linux systems and also deployed information-stealing malware on Windows, putting developer endpoints, CI/CD runners, and potentially production environments at risk.
The package had more than 7 million weekly downloads, raising concern that the compromise could have spread broadly through direct and transitive dependencies, although the total number of affected systems was not known. Maintainers and responders identified the malicious versions in a public GitHub security issue and advised organizations to search lockfiles, caches, node_modules, and internal artifact repositories for the compromised packages, update to a clean release such as 1.0.1, and treat exposed systems as potentially breached by reimaging hosts and rotating credentials and other secrets.
Trace attribution and downstream blast radius.
5 events from the most recent confirmed update back to the earliest known activity.
A GitHub issue titled "Security issue: compromised npm packages of ua-parser-js (0.7.29, 0.8.0, 1.0.0)" was published, documenting the compromised releases. This reflects public disclosure by the project around the malicious package incident.
The highest-risk exposure window occurred on 2021-10-22 from about 12:15 to 16:27 UTC, when the malicious ua-parser-js releases were tagged as the latest versions. During this period, routine installs could pull the compromised package versions automatically.
A supply-chain compromise of the ua-parser-js npm package resulted in malicious versions 0.7.29, 0.8.0, and 1.0.0 being published. The attacker is described as having likely compromised the publisher's npm identity or keys.
Sophos reported that the malicious ua-parser-js releases delivered an XMRig-based Monero miner on Linux and, on Windows, a malicious DLL and packer linked to Qbot-style activity that deployed credential-stealing malware. The analysis also documented geofencing that skipped systems in Russia, Ukraine, Kazakhstan, and Belarus, plus the attacker infrastructure used to fetch payloads.
Following the malicious releases, a clean ua-parser-js version 1.0.1 was available and reported to be free of the implanted code. The malicious versions were also later superseded by benign releases and unpublished.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
4 references tracked. Mallory keeps watching after this page renders.
news.sophos.com
Open sourcecybereason.com
Open sourcetruesec.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Several newly published versions of the widely used npm package **`node-ipc`** were found to be malicious after being released through the legitimate maintainer account, turning a trusted dependency into an active software supply chain attack. Researchers identified **`node-ipc@9.1.6`**, **`9.2.3`**, and **`12.0.1`** as compromised, with the payload embedded in the package’s CommonJS bundle so it executed when applications loaded the library while normal functionality continued. Security firms said any project installing the package directly or transitively could be affected, and described the code as an obfuscated stealer and backdoor that fingerprints hosts, reads local files, and attempts covert data theft. Analysis indicates the malware harvested environment variables and secrets from developer workstations, CI/CD pipelines, cloud platforms, Kubernetes, Docker, SSH configurations, browser profiles, and AI tooling, then compressed, encrypted, and exfiltrated the data through DNS TXT queries using public resolvers and attacker-controlled infrastructure including **`azurestaticprovider.net`**, **`sh.azurestaticprovider.net`**, **`bt.node.js`**, and **`37.16.75.69`**. Investigators said the use of the legitimate maintainer account points to either account compromise or insider abuse, while the campaign appears focused on infrastructure-aware credential theft rather than disruption. Defenders were urged to remove the affected versions from manifests and lockfiles, pin to known-clean releases, audit systems that installed them, and rotate all secrets exposed in any impacted CI/CD environment.
Jun 29, 2026
Multiple `@asyncapi` npm packages were compromised in a software supply-chain attack that inserted a multi-stage malware loader into widely used developer tooling with roughly 2 million weekly downloads. Reports identified malicious versions including `@asyncapi/generator-helpers@1.1.1`, `@asyncapi/generator-components@0.7.1`, `@asyncapi/generator@3.3.1`, and additional trojanized packages in the namespace, with one analysis counting five affected packages. The injected code was hidden in `src/utils.js` and triggered during normal `require()` or import execution rather than npm lifecycle hooks, spawning a detached Node.js child process that fetched an encrypted second-stage payload from IPFS and wrote it to disk as `sync.js` in user-specific directories across macOS, Linux, and Windows. Researchers said the second stage was a **Miasma** variant or related botnet framework that established persistence, beaconed to `85.137.53.71:8080`, and enabled remote shell access for arbitrary command execution. Analyses also described broader built-in capabilities for file operations, credential harvesting, evasion, propagation, mutation, and destructive actions, though some of those functions were reportedly disabled in the observed build. Security firms warned that developer workstations and CI environments using the affected packages may have been exposed, advised avoiding the malicious versions, upgrading once clean releases are available, inspecting systems for compromise, and rotating potentially exposed credentials; one report added that `@asyncapi/specs@6.11.2-alpha.1` remained directly downloadable even after removal from registry metadata.
Sep 3, 2026
Attackers hijacked an Axios maintainer's npm account and published malicious package versions **`axios@1.14.1`** and **`axios@0.30.4`**, turning one of npm's most widely used JavaScript libraries into a supply-chain malware delivery channel. The poisoned releases, tracked as **`MAL-2026-2306`** and **`GHSA-2x9r-6wxq-hrr7`**, reportedly introduced a hidden dependency, **`plain-crypto-js@4.2.1`**, whose `postinstall` behavior fetched a cross-platform remote access trojan for macOS, Windows, and Linux. The attacker is reported to have used a long-lived classic npm token, changed the maintainer account email, and bypassed the project's normal trusted publishing workflow by releasing directly through the npm CLI. The malicious packages were available for roughly three hours before removal, but defenders were urged to treat any host or CI runner that installed them as fully compromised. Reported indicators included outbound connections to **`sfrclak[.]com:8000`** and artifacts such as **`/Library/Caches/com.apple.act.mond`** on macOS, **`%PROGRAMDATA%\wt.exe`** on Windows, and **`/tmp/ld.py`** on Linux, with associated infrastructure including **`142.11.206.73`**. Security guidance called for downgrading to **`axios@1.14.0`** or **`0.30.3`**, blocking the command-and-control domain, rebuilding affected systems from known-good images, rotating exposed credentials, and adopting controls such as delayed installation of newly published npm packages and disabling install scripts in CI/CD where feasible.
Aug 21, 2026