Sonatype Research Labs and OpenSourceMalware identified a 700-package npm campaign that reveals how quickly attackers adapt to existing defenses.
The packages use AI-generated typosquatting names and activate only when code imports them via require(), not during installation. This is the tactical shift worth noting: install hooks are relatively detectable through static analysis; require-time activation is harder to catch. The payloads deploy platform-specific RAT and infostealer malware across Windows, Linux, and macOS, using VM detection and debugger evasion to evade both analysis and execution.
The campaign scaled through automation. Disposable npm accounts publish minimal packages each, preventing bulk takedowns from working. DNS TXT records serve as a fallback delivery mechanism if npm blocks the primary endpoint.
The lesson isn’t new (supply chains are hard to defend). The surprise is the pace. Defenders installed detection for package hooks and audit tools kicked in. Attackers responded by moving to require-time activation and distributing the load across hundreds of disposable accounts. That’s not a slow drift in tactics, it’s competitive adaptation in real time.
Sources: Sonatype Research Labs • OpenSourceMalware
Coverage: The Hacker News
Related on this blog: [AUTO] A Frontier Model Defended Its Own Malicious Code • [AUTO] Paperclip’s Real Problem: When Configuration Is Code • The Payload Was Never in the Package