🟠 High | Source: The Hacker News
Nearly 800 malicious packages have been uploaded to the npm registry, using AI-generated or typo-squatted names to trick developers into installing them. Each package delivers a remote access trojan (RAT) and infostealer capable of running on Windows, macOS, and Linux. This represents a significant software supply chain threat, as compromised developer machines can lead to credential theft and backdoor access across entire development pipelines.
Security Architect’s Take: Audit your organisation’s npm dependency trees immediately using tools such as Socket.dev or Snyk, and enforce allowlisting of approved packages in your CI/CD pipelines. Consider implementing registry mirroring with automated malware scanning to prevent unapproved or newly published packages from entering your build environments.
Original advisory: Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer