Tag: malicious package

Malware

The npm package atomic-lockfile@1.4.2 was used in the Atomic Arch campaign to deliver the deps payload via a preinstall hook. It was…

atomic-lockfile malicious package npm supply chain attack

June 25, 2026

Malware

The npm package js-digest was used in a second wave of the Atomic Arch attack, delivered via bun install. It contained a…

bun js-digest malicious package npm

June 25, 2026