Loading story…
Security researchers reported two separate npm supply-chain compromises that delivered malware and exploit infrastructure to downstream users. One analysis uncovered an obfuscated Node.js stealer designed to run across Windows via WSL, macOS, and Linux, with plaintext modules for browser credential theft, recursive exfiltration of sensitive files, and a WebSocket-based reverse shell. The malware targeted Chromium-based browsers and cryptocurrency wallet extensions, sent browser data, files, and command traffic to 216.126.225.243 over ports 8085, 8086, and 8087, and included host profiling plus an HMAC-SHA256 routine with a hardcoded key. Researchers noted the command-and-control IP had previously been associated with DPRK-linked OtterCookie infrastructure.
In a separate incident, Socket Threat Research said the widely used npm package art-template was compromised after repository control was transferred to an unknown actor, who inserted malicious remote-script loaders into versions 4.13.5 and 4.13.6. The injected code redirected users to a watering-hole framework at utaq.cfww.shop that selectively targeted Safari on iOS 11.0 through 17.2, beaconed device and IP data to l1ewsu3yjkqeroy.xyz, and used anti-bot checks, anti-headless logic, and WebAssembly-based fingerprinting before retrieving gated payloads. Researchers found strong overlap with the Coruna exploit kit, including version-aware targeting, XOR obfuscation, architecture-specific dispatch, and a cutoff at iOS 17.3, with additional similarities noted to UNC6691.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
5 events from the most recent confirmed update back to the earliest known activity.
The analysis revealed exfiltration and command-and-control traffic to 216.126.225.243, with browser data sent to port 8085, files to 8086, and reverse-shell/C2 traffic to 8087. The IP was noted as associated with a DPRK OtterCookie C2, suggesting a possible North Korean linkage.
A static analysis identified an obfuscated Node.js stealer targeting Windows via WSL, macOS, and Linux. Despite the wrapper obfuscation, researchers found three plaintext payloads: a browser credential stealer, a recursive sensitive-file exfiltration module, and a WebSocket-based reverse shell.
The malicious framework selectively targeted Safari on iOS versions 11.0 through 17.2, beaconed victim IP and device version data to l1ewsu3yjkqeroy.xyz, and used anti-bot, anti-headless, and WebAssembly-based fingerprinting before fetching payload modules. Researchers assessed the framework as Coruna or a close derivative, with noted similarities to UNC6691 pending further infrastructure analysis.
After taking over the repository, the actor inserted malicious remote-script loaders into art-template versions 4.13.5 and 4.13.6. The injected code redirected users to a watering-hole framework hosted on utaq.cfww.shop.
Socket Threat Research reported that control of the art-template npm repository was transferred to an unknown actor, enabling a later supply-chain compromise. The exact transfer date was not provided in the reference.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
4 references tracked. Mallory keeps watching after this page renders.
isc.sans.edu
Open sourcedshield.org
Open sourceisc.sans.edu
Open sourcesocket.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The npm package **jscrambler** was compromised through malicious version `8.14.0`, which added an undocumented `preinstall` hook and install-time files that executed hidden native binaries on **Windows, macOS, and Linux** during `npm install`, before application code ran. Researchers said the release appeared to be published directly to npm from a legitimate maintainer account without matching source repository commits or tags, pointing to a likely compromise of the maintainer account or build pipeline. Socket reported detecting the release within minutes of publication and alerted the maintainers, while a subsequent `8.15.0` release appeared clean. Further analysis linked the package to a **Rust-based infostealer** aimed at developer workstations and CI/build environments, creating exposure for source code, environment variables, build credentials, deployment tokens, and other secrets. Reported targets included cloud credentials, browser data, messaging sessions, cryptocurrency wallets, Bitwarden vault contents, and configuration files for AI coding tools such as **Claude Desktop, Cursor, Windsurf, VS Code, and Zed**. Researchers also observed anti-debugging on Windows and macOS, Linux `eBPF` capability, persistence through Windows scheduled tasks and macOS LaunchAgents, and encrypted command-and-control details; because `8.14.0` remained available on npm, pinned installs on older npm clients that still run install scripts could continue to trigger the payload.
Jul 11, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
Security researchers reported a supply-chain attack delivered via a malicious npm package, `ansi-universal-ui`, masquerading as a legitimate UI component library. The package, dubbed **G_Wagon** by Aikido, used a multi-stage infection chain: after installation it executed an obfuscated loader, downloaded its own Python runtime to evade local restrictions, and then ran a Python-based stealer that exfiltrated sensitive data including browser credentials, cryptocurrency wallets, cloud credentials, and Discord tokens to an Appwrite storage bucket. The campaign showed rapid iteration, with roughly 10 package versions published over two days, progressing from basic scaffolding to adding C2 configuration and a “full Python payload with browser injection.” Technical analysis indicated the payload included a large base64 blob that decoded to an XOR-encrypted Windows DLL, which was injected into browser processes using Windows native APIs (e.g., `NtAllocateVirtualMemory`). Separately, reporting highlighted that **npm** and **Yarn** package-manager behaviors can leave “unplugged holes” that attackers may exploit to bypass certain defenses aimed at malicious dependency activity (referencing “Shai-Hulud”), reinforcing the broader risk that package-manager edge cases and ecosystem trust can be leveraged for supply-chain compromise. A paywalled report about a **Firefox WebRTC** RCE with public exploit code appears unrelated to the npm malware activity and does not materially contribute details to this incident.
Jun 29, 2026