Attackers first harvested maintainer credentials through sophisticated phishing emails, then used these stolen tokens to publish malicious package versions directly to npm repositories without making any corresponding changes to GitHub repositories, making the attack significantly harder to detect through traditional monitoring methods. This approach enabled the malware to achieve persistence and remote code execution capabilities while remaining dormant on non-Windows systems, demonstrating the attackers’ understanding of cross-platform development environments and their ability to craft targeted payloads that maximize impact while minimizing detection across diverse development ecosystems. A sophisticated supply chain attack has compromised several widely-used npm packages, including eslint-config-prettier and eslint-plugin-prettier, after threat actors successfully stole maintainer authentication tokens through a targeted phishing campaign. Analysis revealed that the injected code attempted to load and execute a DLL file named node-gyp.dll using the Windows rundll32 utility, potentially providing attackers with complete system access and the ability to execute arbitrary code on compromised machines. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The attack leveraged a typosquatted domain, npnjs.com, designed to mimic the legitimate npmjs.org site and harvest developer credentials through convincing phishing emails. Socket.dev researchers identified the compromise after suspicious activity reports revealed that multiple versions of popular packages were published without corresponding commits or pull requests on GitHub. The malicious code specifically targeted Windows systems with a dangerous payload designed to execute remote commands. The attack’s sophistication lies in its exploitation of npm’s metadata accessibility, where registration emails and maintainer information are easily scraped by threat actors to build comprehensive target lists. With years of experience under his belt in Cyber Security, he is covering Cyber Security News, technology and other news.
This Cyber News was published on cybersecuritynews.com. Publication date: Tue, 22 Jul 2025 01:05:11 +0000