Executive Summary
Microsoft has identified a targeted supply chain campaign by an actor using the alias vpmdhaj, who published 14 malicious npm packages on May 28, 2026. These packages employ typosquatting and spoofed metadata to mimic legitimate search and configuration utilities, primarily targeting developers in the OpenSearch and ElasticSearch ecosystems.
The attack utilizes two generations of stagers to deploy a 195 KB Bun-compiled credential harvester. This second-stage payload is designed to steal high-value secrets including AWS IAM/STS tokens, HashiCorp Vault credentials, and npm publish tokens, which facilitate downstream supply chain pivoting. The campaign is notable for its stealthy execution, including the abuse of the legitimate Bun runtime to evade detection during the installation phase.
Successful compromise grants the adversary the ability to move laterally within cloud environments, exfiltrate data from Secrets Manager, and potentially tamper with CI/CD pipelines. Organizations using npm should immediately audit their environments for the listed packages and rotate any exposed cloud or registry credentials.