[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fDjwYWV4wkM34GH19LiS0_PEJenZzDOQCrgoG4aZftTw":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":21,"status":22,"created_at":23,"published_at":24,"article":25,"tags":29,"podcasts":48,"controls":61},"c8d14fa2-e8ef-41b0-93fb-f7c2c4757ffe","800-malicious-npm-packages-weaponize-developer-pipelines-with-rat-and-infostealer","4dbb86ca-666d-4c7b-bf79-3c0989d4fc24","800 Malicious npm Packages Weaponize Developer Pipelines with RAT and Infostealer","Attackers published nearly 800 malicious npm packages using typosquatting and AI-generated names to trick developers into installing them via routine require() calls, effectively turning the software supply chain into a malware delivery mechanism. Once loaded, the packages fetch cross-platform payloads capable of establishing persistence and deploying remote access tools like Sliver across Windows, Mac, and Linux. This attack exploits the inherent trust developers place in public package registries and the speed at which dependencies are pulled into projects without sufficient vetting. The use of Cloudflare Workers and DNS TXT records for payload delivery demonstrates sophisticated evasion designed to bypass traditional network controls. This matters because a single compromised developer machine can cascade into a full organizational breach or even poison downstream software releases.","**Immediate actions:**\n- Audit all current project dependencies against known-malicious package lists and remove any suspicious or unrecognized packages immediately.\n- Enable npm audit and integrate it into your CI\u002FCD pipeline to flag vulnerable or malicious packages before they reach production.\n- Block outbound connections to unexpected infrastructure (e.g., Cloudflare Workers endpoints) from developer workstations using egress firewall rules.\n\n**Long-term improvements:**\n- Enforce the use of a private, vetted package registry (e.g., Artifactory, Nexus) as a proxy for all public npm packages to prevent direct consumption of unreviewed code.\n- Implement a software composition analysis (SCA) tool such as Snyk, Socket.dev, or OWASP Dependency-Check as a mandatory gate in all build pipelines.\n- Establish a formal dependency review policy requiring human approval for new third-party packages introduced into any codebase.\n\n**Detection measures:**\n- Monitor developer endpoints for anomalous process execution, persistence mechanisms, or unexpected outbound DNS lookups that may indicate RAT activity.\n- Set up alerts for newly introduced dependencies that exhibit typosquatting patterns (e.g., names closely resembling popular packages) using tools like Socket or Phylum.\n- Log and review all package installation events across developer environments to detect unauthorized or unexpected dependency additions.",[12,13,14,15,16,17,18,19,20],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 16: Application Software Security","NIST SP 800-161: Supply Chain Risk Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SSDF (SP 800-218) PW.4: Reuse Well-Secured Software","OWASP A06:2021 – Vulnerable and Outdated Components","SLSA Supply Chain Security Framework: Source and Build Integrity","GDPR Article 32: Security of Processing (for orgs handling EU data)",{},"published","2026-08-07T20:20:37.587133+00:00","2026-08-07T20:20:37.273+00:00",{"id":7,"url":26,"slug":27,"title":28},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F08\u002Fnearly-800-malicious-npm-packages.html","nearly-800-malicious-npm-packages-deliver-cross-platform-rat-and-infostealer-7f2f00","Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer",[30,36,42],{"id":31,"name":32,"slug":33,"description":34,"color":35},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":37,"name":38,"slug":39,"description":40,"color":41},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":43,"name":44,"slug":45,"description":46,"color":47},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[49,55],{"id":50,"date":51,"edition":52,"title":53,"audio_url":54},"c954f343-148b-47bb-8fe2-ae2500ba3ae7","2026-08-09","afternoon","ThreatNoir Weekend Brief — August 9","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-09\u002Fthreatnoir-afternoon-brief-2026-08-09.mp3",{"id":56,"date":57,"edition":58,"title":59,"audio_url":60},"27e65655-5449-450a-9bb0-0a47fae669b6","2026-08-08","morning","ThreatNoir Weekend Brief — August 8","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-08\u002Fthreatnoir-morning-brief-2026-08-08.mp3",[62,66,70],{"slug":63,"name":64,"problem":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":67,"name":68,"problem":69},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",{"slug":71,"name":72,"problem":73},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]