Loading story…
An npx confusion or binary-planting weakness can cause npm to fetch and run an attacker-controlled public package when a requested executable is absent locally. The risk is acute for scoped packages that expose unscoped command names: an attacker can register the corresponding unscoped package name and potentially hijack developer invocations, resulting in arbitrary code execution. A reported proof of concept found that Brave’s @brave/brave-search-mcp-server exposed an unclaimed brave-search-mcp-server binary name that could be targeted through public npm resolution.
The same resolution behavior previously affected Vue CLI, where registration of vue-cli-service could have redirected use of the binary provided by @vue/cli-service. Vue updated its guidance to prevent automatic installation of missing packages:
npx --no vue-cli-service
Organizations should reserve unscoped package and binary names for scoped tools, require explicit scoped invocations, enforce private-registry scoping, and scan repositories and CI/CD workflows for unsafe npx command resolution.
Trace attribution and downstream blast radius.
6 events from the most recent confirmed update back to the earliest known activity.
The research reported potential dependency-confusion risks in OpenAI repositories involving `mapbox-gl.css` and `react-datepicker.css`, and reported internal-tooling or scope-mismatch risks at Stripe, Shopify, Elastic, and Replit involving unreserved names or legacy CLI aliases.
Brave Software was notified about the reported package-name and executable-name mismatch. The company reportedly considered the issue informative because its own infrastructure was not affected.
The researcher reported publishing a harmless `brave-search-mcp-server` proof-of-concept package with a postinstall callback. During local testing, the callback recorded execution on a Windows x64 host running Node.js v24.12.0.
An audit reportedly found that Brave Software's `@brave/brave-search-mcp-server` version 1.2.13 exposed the unscoped `brave-search-mcp-server` executable while the identically named public npm package was unclaimed. This could cause `npx brave-search-mcp-server` to retrieve a public package if no local executable exists.
The npxconfuse open-source scanner was presented as a tool for identifying unclaimed npm package and executable names in local repositories, GitHub organizations, web assets, and package lists. It checks command invocations and scoped-package binary names against npm registry availability.
Vue.js and Vite core-team member Haoqun Jiang updated Vue CLI documentation to recommend `npx --no vue-cli-service`. The change prevents npx from automatically installing a separately registered `vue-cli-service` package when the expected local executable is absent.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See attribution and downstream blast radius, and whether this package or vendor reaches your builds.
2 references tracked. Mallory keeps watching after this page renders.
lab.ctbb.show
Open sourcenodejs-security.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026
Security researchers reported an npm supply-chain compromise involving a malicious package, `polymarket-clob`, that targeted cryptocurrency users by exfiltrating sensitive local files (including `.env`, `wallets.json`, and `keys/*.json`) to attacker-controlled infrastructure. The package was published in the npm registry, downloaded at least 189 times (lower bound), and later removed and replaced with a security placeholder; analysis of the code and infrastructure pivoting linked the campaign to broader activity consistent with wallet-drainer operations and **Vidar** stealer-related infrastructure, including reuse of SSH fingerprints and consistent hosting patterns. Separately, researchers disclosed **six JavaScript “zero-day” bypass issues** across multiple package managers—**npm, pnpm, vlt, and Bun**—that undermine common defensive controls used to reduce supply-chain risk, including disabling lifecycle scripts and relying on lockfile integrity. The issues (dubbed **“PackageGate”**) reportedly enable paths to regain install-time code execution or weaken integrity guarantees via mechanisms such as Git dependency handling, tar extraction behaviors, and incomplete integrity coverage for URL-based tarballs; pnpm, vlt, and Bun were reported as patched, while npm characterized the behavior as “works as expected,” raising concern that package-manager-level weaknesses could enable large-scale compromise even in hardened environments.
Jun 29, 2026
Two high-severity vulnerabilities in **pnpm** exposed developers to supply-chain compromise through routine package installation and automatic package-manager switching. **`CVE-2026-55698`** affects versions before **10.34.2** and **11.5.3** and allows a malicious repository to poison metadata in the first YAML document of `pnpm-lock.yaml`, causing direct pnpm execution to trust lockfile-selected package-manager artifacts and run attacker-chosen pnpm bytes. The vulnerable flow reached package-manager installation and execution during auto-switching, and the fix forces fresh resolution of package-manager entries from trusted registries before execution.
Jun 29, 2026