Malicious NPM Package Installation

David Wharton@whartond

•updated Jul 31, 2025•1•3•81

Detects the installation of specific malicious versions of several npm packages. Threat actors gained access to maintainer accounts via a phishing campaign and published compromised versions containing malware. The payloads ranged from a Windows-based information stealer (Scavenger) to a cross-platform JavaScript backdoor.