[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fGrTlXnwXAloMgtSIHrh2IX4jHzBel9PM15bSCykW8BI":3},{"article":4,"iocs":38,"watch_terms":45,"solutions":46,"lesson":140},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":17,"category":18,"article_tags":22},"73471441-03bb-431d-8e6a-d5574149dab0","Suspected Hijacked Developer Accounts Spread npm Malware","suspected-hijacked-developer-accounts-spread-npm-malware","Sonatype uncovers a sophisticated malware campaign using hijacked npm developer accounts to steal API keys and passwords. Is your dev environment at risk?","Sonatype discovered a sophisticated campaign exploiting compromised npm developer accounts to distribute two malicious packages, sbx-mask and touch-adv, designed to steal API keys, passwords, and environment variables from developer machines. The malware exfiltrated stolen credentials via webhook to a specific email address before GitHub's security team removed the packages on March 19, 2026. Developers who installed these packages are at risk and should immediately rotate credentials and monitor for unauthorized access.","Hijacked npm developer accounts spread credential-stealing malware packages sbx-mask and touch-adv.","https:\u002F\u002Fhackread.com\u002Fsuspected-hijacked-developer-accounts-npm-malware\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F03\u002Fsuspected-hijacked-developer-accounts-npm-malware.jpg","2026-03-26T11:53:46+00:00","2026-03-26T13:00:14.741527+00:00",9,[],"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":17,"icon":19,"name":20,"slug":21},null,"Malware","malware",[23,28,33],{"category":24},{"id":25,"icon":19,"name":26,"slug":27},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":29},{"id":30,"icon":19,"name":31,"slug":32},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":34},{"id":35,"icon":19,"name":36,"slug":37},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[39,42],{"type":21,"value":40,"context":41},"sbx-mask","Malicious npm package designed to steal environment variables and credentials upon installation",{"type":21,"value":43,"context":44},"touch-adv","Malicious npm package designed to steal environment variables and credentials on runtime",[],{"controls":47,"vendors":133},[48,77,106],{"slug":49,"name":50,"problem":51,"products":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[53,61,69],{"vendor_slug":54,"vendor_name":55,"vendor_logo":56,"product_slug":57,"product_name":58,"url":59,"description":60},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":78,"name":79,"problem":80,"products":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-endpoint","Microsoft Defender for Endpoint","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fendpoint-security\u002Fmicrosoft-defender-endpoint","Endpoint detection and response for Windows, macOS, Linux and mobile devices.",{"slug":107,"name":108,"problem":109,"products":110},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[111,119,125],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-curation","JFrog Curation","https:\u002F\u002Fjfrog.com\u002Fcuration\u002F","Blocks malicious and risky open-source packages before they enter your repositories.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":120,"product_name":121,"url":123,"description":124},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":126,"vendor_name":127,"vendor_logo":128,"product_slug":129,"product_name":130,"url":131,"description":132},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[134],{"slug":135,"name":136,"logo_path":137,"roles":138},"sonatype","Sonatype","\u002Fvendor-logos\u002Fsonatype.png",[139],"reported_by",{"slug":141,"title":142,"body":143,"framework_refs":144,"framework_notes":153},"compromised-developer-accounts-enable-supply-chain-attack-via-malicious-npm-packages","Compromised Developer Accounts Enable Supply Chain Attack via Malicious npm Packages","Attackers compromised legitimate npm developer accounts to distribute malicious packages (sbx-mask and touch-adv) that stole sensitive credentials from developer machines. This supply chain attack demonstrates how trusted package repositories can become attack vectors when developer accounts lack proper security controls. The malware specifically targeted valuable assets like API keys, passwords, and environment variables, which could enable further compromise of downstream systems and applications.",[145,146,147,148,149,150,151,152],"CIS Control 5","CIS Control 16","NIST AC-2","NIST AC-6","NIST AT-2","NIST SR-3","NIST SR-4","NIST SI-7",{}]