Trum3it npm Scope Squat: @withgoogle Impersonation by maximus-mcmillan

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects npm package installation activity or network communication originating from npm-related processes that involve identified malicious packages, maintainers, or scopes associated with supply chain attacks. Specifically monitors for the '@withgoogle' scope squatting, as well as specific malicious package names and maintainer accounts, and tracks related outbound network connections to suspicious C2 domains.