← Back to Security Blog

New Supply Chain Attack Targets npm Ecosystem — 15 Malicious Packages Found

Security researchers discover 15 malicious npm packages with 47,000+ combined weekly downloads. Packages mimic popular libraries to steal credentials, inject backdoors, and exfiltrate environment variables.

---

Attack Overview

Socket Security researchers have identified 15 malicious packages in the npm registry that collectively accumulated over 47,000 weekly downloads before detection. The packages used typosquatting and dependency confusion techniques to infiltrate development pipelines.

---

Malicious Packages Identified

Package Name	Mimics	Weekly Downloads	Payload
axois	axios	12,400	Credential theft
react-dom-utils	react-dom	8,200	Backdoor injection
lodash-utils-2	lodash	6,800	Env var exfiltration
express-sessoin	express-session	4,100	Session hijacking
dotenv-expand-cli	dotenv-expand	3,900	Secret theft
webpack-dev-srv	webpack-dev-server	2,800	Reverse shell

6 of 15 packages shown. Full list available in KENSAI's threat intelligence feed.

---

Attack Techniques

Typosquatting

Attackers register package names that are common misspellings of popular libraries. A single character difference — axois vs axios — is enough to catch developers in a hurry.

Dependency Confusion

Some packages used internal-sounding names (e.g., @company-internal/auth-utils) to exploit organizations that mix public and private npm registries without proper scoping.

Postinstall Hooks

All 15 packages execute malicious code during npm install via postinstall scripts. The payloads are obfuscated using Base64 encoding, string concatenation, and dynamic eval() calls.

---

Impact Assessment

• Credential theft: AWS keys, database passwords, API tokens from environment variables
• Backdoor persistence: Modified node_modules files that survive reinstalls
• CI/CD compromise: GitHub Actions secrets, Jenkins credentials, Docker registry tokens
• Supply chain propagation: Infected packages can propagate to downstream consumers

---

Remediation

1. Audit dependencies: Run npm audit and check for typosquatting variants
2. Lock files: Always commit package-lock.json and verify integrity hashes
3. Use scoped packages: Configure npm to only allow @your-org/ scoped internal packages
4. Rotate credentials: If any malicious package was installed, rotate ALL secrets immediately
5. Enable npm audit signatures: Verify package provenance using npm's built-in signature verification