Targeted npm Supply Chain Campaign Against Guardarian

A sophisticated adversary launched a targeted supply chain attack using 36 malicious npm packages mimicking legitimate Strapi CMS plugins. The campaign, attributed to an operator using multiple sock-puppet accounts like 'umarbek1233' and 'kekylf12', progressed through eight distinct payload variants over a 13-hour period. The attack demonstrated deep prior knowledge of the target, specifically referencing 'Guardarian' infrastructure, Jenkins CI pipelines, and even utilizing hardcoded PostgreSQL credentials.

Technically, the actor utilized a diverse array of tactics including Redis 'CONFIG SET' exploitation for arbitrary file writes, Docker container escape via overlay filesystem discovery, and the deployment of fileless persistent reverse shells. The primary objectives were the exfiltration of cryptocurrency wallet mnemonics, API keys, and full database dumps from PostgreSQL and Redis instances.

This campaign represents a critical threat to Strapi-based deployments and cryptocurrency platforms. The use of highly targeted environment paths and hostname gating indicates a tailored intrusion rather than an opportunistic scan, highlighting the necessity for rigorous dependency auditing and environment-specific security controls.