Fake 'Apex' Web3 accelerator seeds npm malware, hijacks AI agents
Elastic ties a fake Web3 accelerator (REF8801) to malicious npm packages that drop stealers and reroute AI-agent traffic through an attacker-controlled MCP server.
Stories tagged: #npm
MALFEX npm campaign resurfaces with imgdecode loader
imgdecode, live on npm with 979 downloads, loads a Windows native addon that pulls shellcode from GitHub and injects it into dllhost.exe — the newest package in the MALFEX campaign.
GitHub hardens npm trusted publishing after SlugFest flaw
GitHub tightened npm's trusted publishing after Bloom Security's 'SlugFest' showed claiming an abandoned repo slug could hijack 1,500+ packages. Unvalidated configs now expire in 48 hours.
MALFEX npm campaign ran 3 years, hit 40,000 downloads
CloudSEK details MALFEX, a single-operator npm campaign active since 2023: 8 malicious packages, 40,000+ downloads, delivering the Overlord RAT and an infostealer.
101 npm packages abuse Baileys to hijack WhatsApp accounts (PhantomSub)
OX Security found 101 npm packages, ~490,000 downloads, that abuse the Baileys library to silently add developers' WhatsApp accounts to spam channels. Most are still live.
Mastra npm scope hijacked: 142 packages backdoored via easy-day-js
Microsoft documents the @mastra npm takeover: 142 packages republished in 88 minutes on June 17 with the easy-day-js typosquat, dropping a cross-platform Node.js infostealer.
Red Hat npm packages backdoored: Miasma worm hits @redhat-cloud-services
Red Hat security bulletin RHSB-2026-006 confirms 32 @redhat-cloud-services npm packages were trojaned on June 1, 2026 with a self-spreading credential-stealing worm derived from Shai-Hulud.
npm supply-chain campaign: 14 typosquats target AWS, Vault, npm tokens
Microsoft says a single maintainer 'vpmdhaj' pushed 14 typosquatted npm packages on May 28 that exfiltrate AWS, ECS, HashiCorp Vault and npm tokens via a Bun-runtime payload.