Suspected Hijacked Developer Accounts Spread npm Malware
Hijacked npm developer accounts spread credential-stealing malware packages sbx-mask and touch-adv.
Sonatype discovered a sophisticated campaign exploiting compromised npm developer accounts to distribute two malicious packages, sbx-mask and touch-adv, designed to steal API keys, passwords, and environment variables from developer machines. The malware exfiltrated stolen credentials via webhook to a specific email address before GitHub's security team removed the packages on March 19, 2026. Developers who installed these packages are at risk and should immediately rotate credentials and monitor for unauthorized access.
AI summary of the linked source. Not reviewed by an editor. How this works
The lesson from this incident
Full lessonAttackers compromised legitimate npm developer accounts to distribute malicious packages (sbx-mask and touch-adv) that stole sensitive credentials from developer machines. This supply chain attack demonstrates how trusted package repositories can become attack vectors when developer accounts lack proper security controls. The malware specifically targeted valuable assets like API keys, passwords, and environment variables, which could enable further compromise of downstream systems and applications.
What helps against this
How we list vendors
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — sbx-mask
- malware — touch-adv