Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

Attackers published nearly 800 malicious npm packages using typosquatting and AI-generated names to trick developers into installing them via routine require() calls, effectively turning the software supply chain into a malware delivery mechanism. Once loaded, the packages fetch cross-platform payloads capable of establishing persistence and deploying remote access tools like Sliver across Windows, Mac, and Linux. This attack exploits the inherent trust developers place in public package registries and the speed at which dependencies are pulled into projects without sufficient vetting. The use of Cloudflare Workers and DNS TXT records for payload delivery demonstrates sophisticated evasion designed to bypass traditional network controls. This matters because a single compromised developer machine can cascade into a full organizational breach or even poison downstream software releases.