npmjs[.]com

Cybersecurity researchers have discovered a new set of malicious npm packages that target users of Alibaba developer tools with a cross-platform remote access trojan (RAT) as part of a sophisticated, targeted software supply chain attack targeting Chinese-speaking environments. One of the packages in question is "lib-mtop," an unscoped package with the same name as a private Alibaba package under the "@ali" scope. Although the npm package was first published sometime in November 2023 with no functionality, three new versions (v1.0.1, v1.0.2, and v1.0.3) were uploaded earlier this March and April. It's currently not clear if this was the result of a maintainer account takeover or the project developer opting to go rogue. Regardless of how the malicious changes were pushed, the newly added changes feature a loader that's designed to fetch a remote JavaScript payload using curl and then execute it. The same maintainer account "ch4ce," which currently redirects to a "not found" error on npmjs[.]com, has also published four other packages: aone-kit, aone-kit-cli, aone-sandbox, and local-config-parser. "The first three are empty wrappers that have the same name as private, @ali-scoped packages which they declare as a dependency in the package.json file," Socket security researcher Karlo Zanki said in an analysis. The last package, local-config-parser, implements a legitimate JSON configuration file parser, but features dependencies that, on their own, are innocuous and are published from other npm user accounts. When combined together, they serve as a conduit for an advanced RAT targeting developers who are likely working in companies that are part of the Alibaba Group. Specifically, the malicious loader functionality is split and embedded into several packages delivered to the targets as part of the same dependency tree. The top-layer packages, which impersonate private packages from the @ali scope, serve as decoys that activate the installation of the dependency tree. "When such a package is installed in an environment that has access to impersonated, scoped private packages, the dependency resolution works as expected, with a little extra functionality delivered through additional dependencies that get installed," Socket explained. As many as 10 top-layer lure packages have been found to depend on "smart-config-manager," which functions akin to a middle-layer bridge that connects them to the malicious packages containing the loader logic. One of the low-layer packages proceeds to contact a GitHub repository to retrieve and store a rule engine configuration, and then it uses it to execute a malicious payload that then contacts a remote server to fetch secondary malware. What's notable about the attack is that the rule engine makes use of the vm module to implement the final phase and perform the payload download depending on the victim's operating system. The payload is retrieved from a domain that masquerades as Alibaba ("aone-cli-next.oss-cn-beijing.aliyuncs[.]com") to blend in and sidestep detection. This stage performs a number of actions - On Windows, it terminates the Alilang enterprise security, VPN, and office productivity app and replaces its core code with a trojanized version. On Linux, it downloads a binary payload to /tmp, runs it as a detached process, and deletes the file from disk after it's loaded into memory. On macOS, it inserts a malicious background script into ~/.zshrc and sets up a 10-minute Launch Agent. The final payload is a complex backdoor equipped with comprehensive command execution, arbitrary file upload and download, host reconnaissance, payload staging, and lateral movement capabilities. It also has the capacity to persist by injecting malicious code into common enterprise collaboration applications like DingTalk, Wukong, and Qoder. Exactly who is behind the campaign is unknown, but the presence of Chinese language comments in the source code, combined with the fact that GitHub commits are timestamped with the UTC+08:00 offset, indicates that it's possibly the work of a Chinese-speaking threat actor going after Chinese-speaking developers using tools belonging to Alibaba Group. "The goal of the campaign seems to be industrial espionage," Zanki noted. "While the number of downloads for the malicious packages is not significant, the impact of the campaign is hard to evaluate, because of the targeted nature and lateral-spread capabilities of the final-stage payload." The complete set of packages associated with the campaign is below - lib-mtop aone-kit aone-kit-cli aone-sandbox local-config-parser smart-config-manager cloud-config-fetcher fast-transform-pipeline aone-cloud-cli colder-cli def-open-client feedback-ai-sdk flight-compare-analyzer lwp-web-client lzd-unified-station-sdk open-worker-cli test-skill-zip uniapi-bridge Users who have installed any of the above packages should assume compromise, rotate sensitive credentials from a clean machine, and audit developer systems for signs of suspicious activity. The disclosure comes as unknown threat actors published a poisoned version of mrmustard (0.7.4), the photonic quantum computing Python library from Xanadu, to run an information stealer capable of harvesting SSH private keys, AWS credentials, and Kubernetes configurations, and exfiltrating them to an attacker server ("metrics.femboy[.]energy"). According to StepSecurity, the payload runs on every package import. Further analysis indicates that the primary maintainer's GitHub account was breached to push the rogue version by probing the project's self-hosted CI runners and exfiltrating its publishing secrets to a webhook[.]site URL. The malware "had three separate persistence mechanisms installed that keep a stealer running long after the package is uninstalled," SafeDep said. "The credential theft targets research and HPC environments, collecting SLURM job queues and GPU inventories alongside the usual cloud secrets."

Cybersecurity researchers have disclosed details of a new malicious supply chain campaign that's targeting developers using OpenAI Codex through a legitimate-looking remote web UI. The tool, named codexui-android, is advertised on GitHub and npm as a remote web UI for OpenAI Codex, attracting over 29,000 weekly downloads. The package is still available for download from the repository. What makes this activity noteworthy is that it's not a traditional attack that uses a typosquat or throwaway package to trick developers. Rather, the malicious code is embedded into a functional npm package that has undergone active development. The associated GitHub repository remains clean. "And for the past month, every single invocation has been quietly exfiltrating your Codex authentication tokens to an attacker-controlled server," Aikido Security researcher Charlie Eriksen said. The nefarious changes are said to have been introduced about a month after the package was published to the registry, likely in an effort to build user trust and expand its reach. The npm account associated with the package is "friuns" (aka Igor Levochkin). Present within the package is code that extracts the contents of Codex's "~/.codex/auth.json" file and exfiltrates them to a remote server ("sentry.anyclaw[.]store") that masquerades as Sentry, a legitimate application monitoring and error tracking platform. The captured data includes the following details: access_token, refresh_token, id_token, and account ID. "The refresh_token doesn't expire," Eriksen said. "An attacker holding it can silently impersonate you indefinitely. A stolen Codex refresh_token goes beyond access to a chat interface -- it's persistent, silent access to whatever that account can do." It's worth mentioning here that every time a user logs in to the Codex app, CLI, or IDE Extension using either ChatGPT or an API key, the login details are cached locally in a plaintext file at ~/.codex/auth.json or in the operating system-specific credential store. "If you use file-based storage, treat ~/.codex/auth.json like a password: it contains access tokens," OpenAI warns in its support documentation. "Don't commit it, paste it into tickets, or share it in chat." Interestingly, the npm package is far from the only delivery vector the threat actor uses to target Codex developers. Aikido said it observed an Android application named OpenClaw Codex Claude AI Agent (package name: "gptos.intelligence.assistant") that runs the npm package within its PRoot sandbox and sends the Codex credentials to the same endpoint. "The APK itself is small (26 MB) and looks clean on a Play pre-publish scan," Eriksen explained. "On first run, it extracts a Termux-derived Linux userland into the app's private storage and runs Node.js inside it via PRoot." "The version is not pinned, so the device pulls whatever is currently published on npm. The exfiltration has been in place since [email protected]. The package runs inside the app's PRoot sandbox, where the in-app Codex sign-in writes its auth.json. Once the user signs in, the package reads that file out of the sandbox and ships the full OAuth blob to sentry.anyclaw.store/startlog." Released by an entity named "BrutalStrike," the Android app has more than 50,000 downloads. The same exfiltration chain has also been flagged in a second Android app linked to BrutalStrike: Codex (package name: "codex.app"), which has been downloaded over 10,000 times. The remaining three apps offered by the developer do not contain the functionality. Upon reaching out to the package author on GitHub, Aikido said they initially posted a comment stating they had lost access to their npm account, only to edit the response and post a different one in which they claimed they are "currently investigating this issue internally" and that they "have started removing the affected functionality and related data." The author further claimed no credential data was shared with any third parties, without answering why this code was inserted only into the npm package build or why they needed access to the Codex tokens in the first place. The X profile linked to the author includes the domain "anyclaw[.]store." WHOIS records indicate that the domain was registered on April 12, 2026, just two days after the very first version of the npm package (version 0.1.72) was uploaded to npmjs[.]com. The development comes as threat actors are increasingly targeting real artificial intelligence (AI) developer tooling and workflows to steal credentials and burrow deeper into the software supply chain. Late last month, the Belgian security company also found that a deleted Google API key remains live for up to 23 minutes, a window that an attacker with access to a leaked key can take advantage of to gain access to user data and other APIs, including those related to Google Gemini. The median revocation window is around 16 minutes. "An attacker holding your deleted key can keep sending requests until one reaches a server that has not caught up," researcher Joe Leon said. "If Gemini is enabled on the project, they can dump files you have uploaded and exfiltrate cached conversations." Although Google first opted not to fix the issue, stating it's a "known property of the system and not a security issue," the tech giant has since decided to treat it as a P0 bug, making it a severe issue that "needs to be addressed immediately." The findings, as with a similar 4-second exploitation window previously observed with deleted Amazon Web Services (AWS) access keys, highlight how credential revocation delays are exploitable and can be used to gain unauthorized access to the cloud environments, while defenders assume the credentials have been revoked.

GitHub has rolled out new controls for npm to improve the security of the software supply chain, giving maintainers the ability to explicitly approve a release prior to the packages becoming publicly available for installation. Called staged publishing, the feature is now generally available on npm. It mandates that a human maintainer pass a two-factor authentication (2FA) challenge to approve a package before it is pushed to the npmjs[.]com. "Instead of a direct publish that immediately makes a package version available to consumers, the prebuilt tarball is uploaded to a stage queue where a maintainer must explicitly approve it before it becomes installable," GitHub said. The Microsoft-owned subsidiary said the change ensures "proof of presence" for every publish, including those that come from non-interactive CI/CD workflows and trusted publishing with OpenID Connect (OIDC) authentication. Before using staged publishing, package maintainers have to meet the following criteria - Have publish access to the package Package already exists on the npm registry, meaning a brand new package cannot be staged 2FA is enabled for the account Developers can use the command "npm stage publish" from the root directory of the package to submit it to a staging area. To use this command, it's essential to update to npm CLI 11.15.0 or newer. For optimal protection, GitHub is recommending that staged publishing be paired with trusted publishing using OIDC. A second update focused on npm relates to the introduction of three new install source flags alongside the existing -allow-git flag - --allow-file: Controls installs from local file paths and local tarballs --allow-remote: Controls installs from remote URLs, including https tarballs --allow-directory: Controls installs from local directories The flags allow developers to "apply the same explicit-allowlist approach to every non-registry install source," GitHub said. The development comes amid a massive surge in software supply chain attacks targeting open-source ecosystems over the past few months, with one cybercriminal group known as TeamPCP poisoning popular packages at an unprecedented scale through a self-perpetuating cycle of compromises.

Cybersecurity researchers have uncovered yet another active software supply chain attack campaign targeting the npm registry with over 100 malicious packages that can steal authentication tokens, CI/CD secrets, and GitHub credentials from developers' machines. The campaign has been codenamed PhantomRaven by Koi Security. The activity is assessed to have begun in August 2025, when the first packages were uploaded to the repository. It has since ballooned to a total of 126 npm libraries, attracting more than 86,000 installs. Some of the packages have also been flagged by the DevSecOps company DCODX - op-cli-installer (486 Downloads) unused-imports (1,350 Downloads) badgekit-api-client (483 Downloads) polyfill-corejs3 (475 Downloads) eslint-comments (936 Downloads) What makes the attack stand out is the attacker's pattern of hiding the malicious code in dependencies by pointing to a custom HTTP URL, causing npm to fetch them from an untrusted website (in this case, "packages.storeartifact[.]com") as opposed to npmjs[.]com each time a package is installed. "And npmjs[.]com doesn't follow those URLs," security researcher Oren Yomtov laid out in a report shared with The Hacker News. "Security scanners don't fetch them. Dependency analysis tools ignore them. To every automated security system, these packages show '0 Dependencies.'" More worryingly, the fact that the URL is attacker-controlled means that it can be abused by the bad actor to tailor their payloads and serve any kind of malware, and make it more stealthy by initially serving completely harmless code before pushing a malicious version of the dependency after the package gains broader adoption. The attack chain kicks off as soon as a developer installs one of the "benign" packages, which, in turn, leads to the retrieval of the remote dynamic dependency (RDD) from the external server. The malicious package comes with a pre-install hook that triggers the execution of the main payload. The malware is designed to scan the developer environment for email addresses, gather information about the CI/CD environment, collect a system fingerprint, including the public IP address, and exfiltrate the results to a remote server. Koi Security said the choice of the package names is not random, and that the threat actor has resorted to capitalizing on a phenomenon called slopsquatting – where large language models (LLMs) hallucinate non-existent yet plausible-sounding package names – in order to register those packages. "PhantomRaven demonstrates how sophisticated attackers are getting [better] at exploiting blind spots in traditional security tooling," Yomtov said. "Remote Dynamic Dependencies aren't visible to static analysis. AI hallucinations create plausible-sounding package names that developers trust. And lifecycle scripts execute automatically, without any user interaction." The development once again illustrates how threat actors are finding novel ways to hide malicious code in open-source ecosystems and fly under the radar. "The npm ecosystem allows easy publishing and low friction for packages," DCODX said. "Lifecycle scripts (preinstall, install, postinstall) execute arbitrary code at install time, often without developer awareness."

After Shai-Hulud, GitHub tightens npm publishing security Attackers are constantly finding ways to take over accounts and push malicious packages to the npm registry, the (GitHub-operated) online repository for JavaScript and Node.js packages. But in this month alone, we witnessed the compromise of popular code packages after a successful phishing campaign, and the Shai-Hulud attack, which involved the use of a self-replicating worm-like payload that ultimately compromised over 500 packages and compromised many secrets. While GitHub has managed to put a stop to Shai-hulud’s replication and has blocked the uploading of new packages containing the malware’s indicators of compromise, they also realized that they will have to make changes to prevent similar attacks in the future. Planned security improvements GitHub is working towards a future where: 1. Local package publishing will require 2FA GitHub is planning to remove the option to bypass 2FA for local package publishing, and will deprecate time-based one-time password (TOTP) 2FA. Users will be migrated to FIDO-based 2FA. 2. Trusted publishing is adopted and used more widely Trusted publishing is a system that lets package repositories trust specific workflows or services to publish code using short-lived OpenID Connect identity tokens instead of long-lived API keys. This reduces the chance of stolen credentials being used to spread malicious packages. At the moment, npm trusted publishing only supports GitHub Actions and GitLab Pipelines, but GitHub plans to expand the list of eligible CI/CD providers for trusted publishing. Adding a trusted publisher on npmjs.com (Source: npm registry) 3. The granular access tokens will have a restricted lifetime Granular tokens with publishing permissions will have a maximum lifetime of 7 days. Legacy classic tokens will be deprecated. Publishing access will disallow tokens by default and push users towards trusted publishers or 2FA enforced local publishing. A gradual rollout “We recognize that some of the security changes we are making may require updates to your workflows. We are going to roll these changes out gradually to ensure we minimize disruption while strengthening the security posture of npm,” said Xavier René-Corail, GitHub’s senior director of security research. “We’re committed to supporting you through this transition and will provide future updates with clear timelines, documentation, migration guides, and support channels.” In the meantime, npm maintainers have been encouraged to switch to WebAuthn for two-factor authentication; start using npm trusted publishing instead of tokens; and enforce the use of 2FA for package publishing and settings modification. Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!

The maintainers of the Python Package Index (PyPI) repository have issued a warning about an ongoing phishing attack that's targeting users in an attempt to redirect them to fake PyPI sites. The attack involves sending email messages bearing the subject line "[PyPI] Email verification" that are sent from the email address noreply@pypj[.]org (note that the domain is not "pypi[.]org"). "This is not a security breach of PyPI itself, but rather a phishing attempt that exploits the trust users have in PyPI," Mike Fiedler, PyPI Admin, said in a post Monday. The email messages instruct users to follow a link to verify their email address, which leads to a replica phishing site that impersonates PyPI and is designed to harvest their credentials. But in a clever twist, once the login information is entered on the bogus site, the request is routed to the legitimate PyPI site, effectively fooling the victims into thinking that nothing is amiss when, in reality, their credentials have been passed on to the attackers. This method is harder to detect because there are no error messages or failed logins to trigger suspicion. PyPI said it's looking at different methods to handle the attack. In the meanwhile, it's urging users to inspect the URL in the browser before signing in and refrain from clicking on the link if they have already received such emails. If you're unsure whether an email is legitimate, a quick check of the domain name—letter by letter—can help. Tools like browser extensions that highlight verified URLs or password managers that auto-fill only on known domains can add a second layer of defense. These kinds of attacks don’t just trick individuals; they aim to gain access to accounts that may publish or manage widely used packages. "If you have already clicked on the link and provided your credentials, we recommend changing your password on PyPI immediately," Fiedler said. "Inspect your account's Security History for anything unexpected." It's currently not clear who is behind the campaign, but the activity bears striking similarities to a recent npm phishing attack that employed a typosquatted domain "npnjs[.]com" (as opposed to "npmjs[.]com") to send identical email verification emails to capture users' credentials. The attack ended up compromising seven different npm packages to deliver a malware called Scavenger Stealer to gather sensitive data from web browsers. In one case, the attacks paved the way for a JavaScript payload that captured system information and environment variables, and exfiltrated the details over a WebSocket connection. Similar attacks have been seen across npm, GitHub, and other ecosystems where trust and automation play a central role. Typosquatting, impersonation, and reverse proxy phishing are all tactics in this growing category of social engineering that exploits how developers interact with tools they rely on daily.