Executive Summary
In June 2026, a coordinated supply chain campaign dubbed Operation Friday Harvest targeted the npm ecosystem. The actor deployed 15 malicious packages across 13 distinct scopes, including identities like @apexcraft, @briskforge, and @zynkit. While masquerading as legitimate developer utilities such as JWT helpers and loggers, these packages contain heavily obfuscated JavaScript loaders that execute via postinstall hooks or during package invocation.
The attack chain involves an initial downloader fetching a 10.6 MB Rust-based binary from GitHub Releases. This second-stage payload is a sophisticated infostealer capable of harvesting data from over 30 cryptocurrency wallets, browser credentials, cloud tokens (AWS, GCP, Azure), SSH keys, and developer environment files. The malware establishes persistence as a systemd user service disguised as legitimate system daemons and exfiltrates data via the Telegram Bot API or HTTP POST requests.
This campaign is particularly deceptive because attackers frequently scrubbed the 'latest' version tag on the npm registry to hide malicious hooks from metadata scanners, while leaving previous versions infected. Organizations should audit their dependency trees for any versions of the identified scopes and rotate all credentials on potentially affected systems.