NPM install hook exfiltrates environment
credential-theft/env
Fallout in github, Aug 3 – Aug 9
What we caught this week while monitoring over 163,702,362 artifacts across 47 ecosystems. Campaigns that impact multiple packages are collapsed into a single entry with their siblings.
SUNDAY
Sun Aug 9 · 4 catches · 0 waves · 3 singlesMalicious embedded archive member
dropper/runtimecredential-theft/env
curl-piped-to-shell remote loader
execution/stealth-spawnsandbox-detect/suite
SATURDAY
Sat Aug 8 · 7 catches · 0 waves · 3 singlesTHURSDAY
Thu Aug 6 · 2 catches · 0 waves · 2 singlesnpm postinstall installs unrestricted Claude worker
execution/stealth-spawnsystem/git-hooks
AMSI patch evasion in ScreenToGif
anti-av/amsiplatform/defender
WEDNESDAY
Wed Aug 5 · 1 catch · 0 waves · 1 singleTrojanized tailwindcss dependency
depends on hostile npm: tailwindcss v3.4.19execution/payload
MONDAY
Mon Aug 3 · 1 catch · 0 waves · 1 singleclipboard stealing, UI spying, evasion
clipboard/monitormanipulation/core
O objectives H behaviours Md metadata · a group subscript counts categories, an atom subscript subcategories