Loading story…
A sophisticated supply chain attack on the NPM ecosystem compromised more than 40 packages, including the widely used @ctrl/tinycolor. The attack leveraged a self-propagating malware that trojanized downstream packages, harvested credentials, and injected persistent malicious GitHub Actions workflows. Immediate remediation steps include removing affected packages, rotating all credentials, and auditing infrastructure for signs of compromise.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
CSIRT.SK reported a supply-chain attack in the npm registry in which hundreds of packages from multiple maintainers were republished with malicious code. The report described abuse of the NpmModule.updatePackage function to inject malware that stole secrets, including GitHub and cloud tokens, and could enable remote command execution on Windows and Linux systems.
Initial story creation
On September 15, attackers used a phishing email disguised as an npm security alert to compromise a package maintainer account and inject malicious code into widely used JavaScript packages. The campaign marked the start of the npm supply-chain attack later linked to hundreds of impacted packages.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
5 references tracked. Mallory keeps watching after this page renders.
trendaisecurity.com
Open sourcecsirt.sk
Open sourcesocket.dev
Open sourcegetsafety.com
Open sourcestepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A sophisticated supply chain attack on the npm registry compromised over 40 packages, including those under @ctrl, @nativescript-community, and CrowdStrike namespaces. The attack used a malicious bundle.js script to steal developer credentials and inject persistent GitHub Actions workflows, resulting in widespread credential theft and repository compromise. Affected systems must be treated as fully compromised, with immediate secret rotation and environment audits recommended.
Jun 29, 2026
A series of sophisticated supply chain attacks have targeted the NPM ecosystem, compromising both widely used and niche packages to deliver malicious payloads. The "Shai-Hulud" campaign has infected at least 187 NPM packages, including the highly popular tinycolor package, which receives approximately 2 million downloads weekly. Attackers in this campaign modify package manifests, inject malicious files, and republish the compromised packages, resulting in downstream projects unknowingly incorporating malicious code. The worm-like nature of the attack allows it to spread rapidly to other maintainers' packages, amplifying the impact across the software supply chain. Delayed detection of these compromises increases the risk, as many projects may already be affected before the breach is discovered. The attack highlights the critical importance of verifying package signatures and maintaining a robust software bill of materials (SBOM) to trace dependencies and versions accurately. In a related but distinct campaign, a threat actor using the NPM account "ongtrieuhau861.001" has published at least 94 malicious packages, many of which are specifically crafted to target Asian banks. These packages, often named with the pattern "dhhdbankxxxxx" and similar variants, deliver a JavaScript-based Remote Access Trojan (RAT) dubbed "DHSollutionsBot." This RAT leverages Firebase Realtime Database for command and control, while exfiltrating stolen data through Discord webhooks, making detection more challenging due to the use of legitimate cloud services. The threat actor's NPM account history suggests either a long-term operation or the acquisition of an existing account for malicious purposes. The attack architecture is notable for its simplicity and effectiveness, combining two legitimate platforms for resilient and stealthy C2 operations. Both campaigns underscore the growing threat of supply chain attacks in the open-source ecosystem, where a single compromised package can have cascading effects on countless downstream projects. Developers and organizations are urged to implement cryptographic signing of packages, verify signatures before use, and maintain detailed SBOMs to mitigate the risk of such attacks. The incidents also demonstrate the need for continuous monitoring of package repositories and automated detection tools to identify and respond to malicious activity promptly. The use of trusted platforms like Discord and Firebase for C2 communications further complicates detection and response efforts. These attacks serve as a stark reminder that even well-established codebases can become vectors for compromise if their dependencies are not rigorously vetted and monitored. The campaigns have prompted renewed calls for improved security practices in the software development lifecycle, particularly in the management of third-party dependencies. Organizations are advised to review their exposure to affected NPM packages and take immediate remediation steps where necessary. The incidents highlight the evolving tactics of threat actors in targeting the software supply chain and the critical need for industry-wide vigilance.
Jul 12, 2026A major supply chain attack has compromised 18 widely used npm packages, including chalk, debug, and ansi-styles, with over 2.6 billion weekly downloads collectively. Attackers used phishing and stolen credentials to access a maintainer's account, injecting malware into the packages' index.js files to hijack browser and wallet interfaces for cryptocurrency theft. The incident highlights the critical risks of upstream attacks in open-source ecosystems.
Jun 29, 2026