[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fNnxOGElVQLOAOoWOaDjWL-mYtBy7wBiOmHve7T9ro-4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":20,"status":21,"created_at":22,"published_at":23,"article":24,"tags":28,"podcasts":41,"controls":48},"9af274dd-40c5-40b5-a5ec-ac3303c2a491","compromised-developer-accounts-enable-supply-chain-attack-via-malicious-npm-packages","73471441-03bb-431d-8e6a-d5574149dab0","Compromised Developer Accounts Enable Supply Chain Attack via Malicious npm Packages","Attackers compromised legitimate npm developer accounts to distribute malicious packages (sbx-mask and touch-adv) that stole sensitive credentials from developer machines. This supply chain attack demonstrates how trusted package repositories can become attack vectors when developer accounts lack proper security controls. The malware specifically targeted valuable assets like API keys, passwords, and environment variables, which could enable further compromise of downstream systems and applications.","**Long-term improvements:**\n- This attack could have been prevented through stronger access controls on developer accounts, including mandatory multi-factor authentication (MFA) for npm publishing accounts and regular security awareness training for developers about account security\n- implementing least-privilege access principles and network segmentation could limit the impact of credential theft from developer machines\n\n**Detection measures:**\n- Organizations should implement software composition analysis tools to scan dependencies for malicious packages, maintain an inventory of approved packages, and establish secure development practices that include credential rotation and monitoring",[12,13,14,15,16,17,18,19],"CIS Control 5","CIS Control 16","NIST AC-2","NIST AC-6","NIST AT-2","NIST SR-3","NIST SR-4","NIST SI-7",{},"published","2026-03-26T13:08:44.013687+00:00","2026-03-26T13:08:43.902+00:00",{"id":7,"url":25,"slug":26,"title":27},"https:\u002F\u002Fhackread.com\u002Fsuspected-hijacked-developer-accounts-npm-malware\u002F","suspected-hijacked-developer-accounts-spread-npm-malware","Suspected Hijacked Developer Accounts Spread npm Malware",[29,35],{"id":30,"name":31,"slug":32,"description":33,"color":34},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":36,"name":37,"slug":38,"description":39,"color":40},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[42],{"id":43,"date":44,"edition":45,"title":46,"audio_url":47},"ca474074-8b77-4a70-a208-05f0d91e8c18","2026-03-26","afternoon","ThreatNoir Afternoon Brief — March 26","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-03-26\u002Fthreatnoir-afternoon-brief-2026-03-26.mp3",[49,53,57],{"slug":50,"name":51,"problem":52},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":54,"name":55,"problem":56},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":58,"name":59,"problem":60},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]