Loading story…
Researchers disclosed multiple software supply chain attacks that abused trusted package and plugin distribution paths to steal secrets and execute attacker code. SlowMist detailed the TrapDoor operation, which spread through more than 34 malicious packages and 384 versions across npm, PyPI, and Crates.io, using postinstall hooks, Python import-time execution, and Rust build.rs scripts to harvest credentials, cloud secrets, browser data, and cryptocurrency wallet files. The npm branch added encrypted exfiltration, arbitrary command execution, Git hook injection, shell persistence, and poisoning of AI-assistant context files such as .cursorrules and CLAUDE.md, while infrastructure on GitHub Pages, raw.githubusercontent.com, api.github.com, and webhook.site helped the traffic blend into normal developer activity.
A separate SlowMist investigation found that legitimate npm package node-ipc was compromised through malicious releases 9.1.6, 9.2.3, and 12.0.1, which appended obfuscated code to node-ipc.cjs and exfiltrated AWS credentials, SSH keys, environment variables, and host data over fragmented DNS queries after applications loaded the package with require("node-ipc"). In parallel, ToolJet disclosed a critical instance-wide remote code execution flaw in ToolJet 3.x that let any authenticated builder overwrite a globally shared marketplace plugin with attacker-controlled JavaScript, causing server-side execution whenever other users ran queries through the poisoned plugin; the advisory cited weak authorization, shared plugin records, unsafe vm.runInNewContext() exposure of require and process, and missing integrity checks for plugin code fetched from GitHub.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
A GitHub security advisory disclosed a critical ToolJet 3.x vulnerability that lets any authenticated builder overwrite a globally shared marketplace plugin with attacker-controlled JavaScript, leading to instance-wide server-side remote code execution. The advisory documented the authorization flaw, unsafe execution path, and a proof of concept for plugin poisoning and query-triggered execution.
SlowMist published an analysis of the TrapDoor campaign, linking Python and npm samples through shared infrastructure and detailing credential theft, persistence, AI context poisoning, and exfiltration techniques. The report also examined a Rust package that stole wallet files during compilation, though SlowMist said its linkage to the broader cluster was not independently verified at code level.
The TrapDoor cross-ecosystem supply chain operation was first disclosed by Socket.dev on May 24, 2026. The campaign involved more than 34 malicious packages and 384 published versions across npm, PyPI, and Crates.io.
SlowMist identified three malicious node-ipc releases—9.1.6, 9.2.3, and 12.0.1—published on May 14, 2026. The poisoned versions appended obfuscated code to the CommonJS entry file to steal credentials and exfiltrate data via fragmented DNS queries.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
slowmist.medium.com
Open sourceslowmist.medium.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026
Open-source software supply chain risk continued to escalate, with reporting citing **454,600+** newly identified malicious packages across major repositories (including **PyPI, npm, Maven Central, NuGet, and Hugging Face**) and tactics ranging from **credential theft** to **multi-stage attacks** and even early **self-replicating** package malware. The activity reportedly concentrated heavily in **npm**, including high-volume “ecosystem flooding” (e.g., single accounts publishing **150,000+** malicious packages in days) and **hijacking of trusted projects**, exploiting developer reliance on superficial trust signals such as package names, READMEs, and download counts. Separately, researchers disclosed **“PackageGate”** vulnerabilities in JavaScript package managers (**npm, pnpm, vlt, and Bun**) that can bypass common post-incident defenses—namely `--ignore-scripts` and lockfile integrity—enabling malicious code execution via compromised dependencies. Koi Security reported six issues; **pnpm, vlt, and Bun** shipped fixes, while **npm** reportedly treated the behavior as expected. In parallel, threat actors abused **GitHub’s fork architecture** to distribute a spoofed *GitHub Desktop* installer promoted via search ads; execution deployed **HijackLoader** and established persistence via a **scheduled task**, underscoring that supply chain threats extend beyond package registries into developer tooling distribution channels.
Jun 29, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026