This is an impressive piece of malware. Its sophistication says nation-state to me, but there is no direct evidence and certainly no attribution.
Malicious npm Packages That Evade Defenses
About this summary. This is a short, independently written summary of an article first published by Schneier on Security. Cyber Security News did not report or verify the underlying story. Read the original: https://www.schneier.com/blog/archives/2026/09/malicious-npm-packages-that-evade-defenses.html
Source attribution: headline and facts are from Schneier on Security (schneier.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
DistillGuard: Malicious NPM Package Detection and API Attack Chain Analysis via Static Graph and LLM Distillation
arXiv:2609.28996v1 Announce Type: new Abstract: The Node.js ecosystem heavily relies on NPM packages, and software supply chain attacks targeting malicious NPM packages…
npm registry keeps removed-version timestamps but drops the reason (Sept 2025 campaign as evidence)
Posted by ezraax on Sep 23 Hi, Sharing a registry-metadata observation that matters for supply-chain incident response. I audited npm's public package documents and…
Compromised MemTensor Packages Deliver sckit Credential Stealer via npm and PyPI
Unknown threat actors have managed to compromise two legitimate MemTensor packages across the npm and Python Package Index (PyPI) repositories to push a…
Malicious npm Package Poses as Twilio Bug-Bounty Probe, Can Exfiltrate Credentials
Cybersecurity researchers have disclosed details of a malicious npm package named "tw-pkgprobe-7731" that masquerades as a security tool targeting developers integrating…
Shai-Hulud Attack Nips Cyber-Firm CrowdSec's GitHub Data
Threat actors stole 170 private repositories using an OAuth token stolen from a former employee's computer through the TanStack npm supply chain attack.
Malicious B-tree NPM Package Accumulates Millions of Downloads
Posing as the legitimate sorted-btree package, indexed-btree hides a malware trigger in its prototype method.