33 malicious npm packages exploit dependency confusion for developer environment reconnaissance
Threat actor deployed obfuscated reconnaissance payloads across nine organizational scopes using dependency confusion and spoofed enterprise metadata, executing silently via npm postinstall hooks.
Attack Brief
Targetnpm package manager; developer environments across multiple organizationsVectorDependency confusion via malicious scoped packages with postinstall lifecycle hooks; spoofed internal enterprise infrastructure URLsAttributionunattributed
Technical Details
MITRE ATT&CKT1195.001T1036T1592T1087T1083T1518T1057IoCsmr.4nd3r50n@[email protected]@yandex.ru@cloudplatform-single-spa@wb-track@data-science@ce-rwb@payments-widget@travel-autotests@[email protected]@sber-ecom-coresvp-baasenterprisemonitoringssh-keysshared-frontpayments-widget-sdkadd_application_service_tokenui-kitsberpay-widgetAffectednpm packages published May 28–29, 2026; version numbers include 100.100.100, 3.5.22, 5.7.1, 99.5.7, 99.5.8, 99.0.7
Impact
Sectorsfinancial servicestechnologyConfirmed DamageReconnaissance-only payload deployed; environment fingerprinting, credential exfiltration via environment variables, system information collection; architecture includes RECON_ONLY flag for server-side toggle to full exploitation in follow-on attacks
Mitigation
Patchesnpm repositories and maintainer accounts taken down per Microsoft Threat Intelligence coordination with npm teamDetectionMonitor npm postinstall hook execution; inspect package.json for spoofed enterprise metadata URLs; detect HTTPS connections to attacker C2 endpoints during npm install; flag packages with absurdly high version numbers (e.g., 100.100.100) or pre-staged organizational scope registrations; analyze obfuscated JavaScript payloads for environment variable exfiltration patterns