36 Malicious npm Strapi Packages Target Crypto Platforms, React2Shell Harvests 766 Hosts, North Korea Hijacks Axios via Social Engineering

The npm ecosystem is under triple siege: 36 fake Strapi plugins deploy persistent implants targeting cryptocurrency platforms via Redis and PostgreSQL exploitation. Automated React2Shell campaigns harvest credentials from 766 hosts in 24 hours. North Korean hackers social-engineer an Axios maintainer through a fake Microsoft Teams error. Meanwhile, a TrueConf zero-day targets Asian governments, and Apple expands DarkSword exploit protections.

---

📦 36 Malicious npm Strapi Packages Deploy Persistent Implants Targeting Crypto Platforms

SafeDep has discovered 36 malicious packages in the npm registry, all masquerading as legitimate Strapi v3 community plugins. The packages follow a naming convention starting with strapi-plugin- — while official Strapi plugins use the scoped @strapi/ namespace.

How the Attack Works

• Postinstall hook execution — malicious code runs automatically on npm install with no user interaction required
• Root-level access in CI/CD — executes with the installing user's privileges, often root in Docker containers and pipelines
• Eight evolving payloads — the attacker iterated through increasingly sophisticated approaches over 13 hours

Payload Evolution

The campaign shows a clear progression from aggressive exploitation to targeted persistence:

• Phase 1: Redis RCE via crontab injection — downloads and executes shell scripts every minute, deploys PHP web shells and Node.js reverse shells
• Phase 2: Docker container escape combined with Redis exploitation — writes payloads to the host system outside the container
• Phase 3: Environment variable scanning and PostgreSQL credential harvesting
• Phase 4: Expanded reconnaissance — Strapi config extraction, Redis database dumps, network topology mapping, Docker/Kubernetes secret harvesting
• Phase 5: Direct PostgreSQL exploitation using hard-coded credentials — querying Strapi tables for crypto-related patterns (wallet, transaction, deposit, withdraw, hot, cold, balance)
• Phase 6: Persistent implant targeting a specific hostname (prod-strapi) with credential theft

The use of hard-coded database credentials and hostname targeting strongly suggests the attacker had prior access to the target environment — likely through an earlier compromise. Four sock puppet npm accounts uploaded all 36 packages in a single 13-hour window.

Action: Audit all Strapi plugin dependencies. Ensure you're using scoped @strapi/ packages only. If any of the 36 listed packages are installed, consider the system fully compromised — rotate all credentials, database access tokens, and cryptocurrency wallet keys immediately.

---

🌐 React2Shell Automated Campaign Harvests Credentials From 766 Hosts in 24 Hours

Cisco Talos has published a detailed analysis of UAT-10608, a threat cluster running an industrial-scale credential harvesting operation via the React2Shell vulnerability (CVE-2025-55182) in Next.js applications.

The NEXUS Listener Framework

Researchers gained access to an exposed instance of the attacker's NEXUS Listener command-and-control platform, revealing the full scope of operations:

• 766 hosts compromised within 24 hours across multiple cloud providers and geographic regions
• Multi-phase credential harvesting — automated scripts deployed post-exploitation to extract:
• Environment variables, API keys, database credentials
• SSH private keys
• AWS/GCP/Azure cloud credentials and IAM tokens
• Kubernetes tokens and Docker secrets
• GitHub/GitLab tokens, Stripe API keys
• Shell command history and process runtime data
• Chunked exfiltration — data sent via HTTP over port 8080 with a web GUI providing search, filtering, and statistics

The stolen credentials enable cloud account takeover, supply chain attacks, lateral movement via SSH keys, and database access including payment systems. Affected organizations also face regulatory exposure from privacy law violations.

Action: Patch Next.js immediately for CVE-2025-55182. Audit server-side data exposure. Rotate all credentials if compromise is suspected. Enforce AWS IMDSv2, replace reused SSH keys, enable secret scanning, and deploy WAF/RASP protections for Next.js applications.

---

🇰🇵 North Korean Hackers Hijack Axios npm Package via Social Engineering

The maintainers of Axios, one of the most popular HTTP client libraries in the JavaScript ecosystem, have published a detailed post-mortem revealing how North Korean hackers infiltrated their project.

The Social Engineering Chain

1. Fake company impersonation — attackers cloned a legitimate company's branding, including founders' likenesses, and created a convincing Slack workspace with staged channels and fake profiles of employees and other OSS maintainers
2. Microsoft Teams meeting — the lead maintainer was invited to a scheduled call that appeared to include numerous participants
3. Fake Teams error — during the call, a technical error prompted the maintainer to install an "update" — actually a RAT (WAVESHAPER.V2)
4. Credential theft — the RAT gave attackers remote access to the maintainer's device, allowing them to obtain npm credentials
5. Malicious versions published — Axios versions 1.14.1 and 0.30.4 were pushed with a dependency (plain-crypto-js) containing a cross-platform RAT

Google Threat Intelligence Group attributes the attack to UNC1069, a financially motivated North Korean threat actor active since 2018. The malicious versions were live for approximately three hours before removal.

Action: Check for Axios versions 1.14.1 or 0.30.4 in any project. If installed during the exposure window, consider the system compromised. Rotate all credentials and authentication keys. OSS maintainers should be vigilant against social engineering — verify all software updates through official channels only.

---

🎥 TrueConf Zero-Day Exploited in Attacks on Asian Governments

SecurityWeek reports that a Chinese threat actor has been exploiting a previously unknown vulnerability in the TrueConf video conferencing platform to target government organizations across Asia. The attack chain involves:

• Initial access via zero-day — exploiting TrueConf to gain a foothold in government networks
• Reconnaissance — mapping internal network infrastructure and identifying high-value targets
• Privilege escalation — moving from initial access to administrative-level permissions
• Payload deployment — installing additional tools for persistent access and data exfiltration

This follows a growing trend of state-sponsored actors targeting collaboration and video conferencing platforms as entry points into government networks. Organizations using TrueConf should monitor for indicators of compromise and apply patches as soon as they become available.

---

🍎 Apple Expands DarkSword Exploit Protections to More Devices

Apple is rolling out additional protections against the DarkSword exploit kit to a wider range of devices. The DarkSword kit, which was leaked on GitHub in late March, has been used by both state-sponsored hackers and commercial spyware vendors to target iPhone users.

Key updates:

• Expanded device coverage — protections now reach older iPhone and iPad models that were previously unpatched
• Kernel-level mitigations — addressing the exploit chain components that enable privilege escalation
• Lockdown Mode enhancements — additional hardening for users at elevated risk of targeted surveillance

Users should update all Apple devices immediately. Those at high risk of targeted surveillance (journalists, activists, diplomats) should enable Lockdown Mode for maximum protection.

---

🏥 European Commission Confirms 300GB+ Breach Linked to Trivy Supply Chain Attack

The European Commission has confirmed a data breach linked to the Trivy supply chain attack, with hackers stealing over 300GB of data from the Commission's AWS environment, including personal information.

This marks the second major breach of EU institutions in recent months, following the TeamPCP/CERT-EU incident that exposed data from 30 Union entities. The breach raises serious questions about supply chain security in critical government infrastructure and the cascading impact of compromised open-source security tools.

---

📋 Quick Hits

---

🛡️ Recommended Actions

1. npm Supply Chain Security: Audit all dependencies for the 36 malicious Strapi packages. Use scoped packages (@strapi/) only. Implement npm audit in CI/CD pipelines. Consider using lockfiles and package provenance verification.
2. Next.js Operators: Patch CVE-2025-55182 (React2Shell) immediately. Deploy WAF rules to block exploitation attempts. Rotate all environment secrets if you run unpatched Next.js instances.
3. OSS Maintainers: Enable hardware-based 2FA on all package registry accounts. Verify all software updates through official channels only. Be extremely cautious of unsolicited meeting invitations from unknown companies — especially those involving "error fix" installations.
4. Video Conferencing: Organizations using TrueConf should apply the latest patches and monitor for IOCs. Consider network segmentation to limit lateral movement from collaboration tools.
5. Apple Users: Update all devices immediately. Enable Lockdown Mode if you are at elevated risk of targeted surveillance.
6. Cryptocurrency Operations: Audit all Strapi-based infrastructure. Rotate database credentials, API keys, and wallet keys. Monitor for unauthorized access patterns in Redis and PostgreSQL logs.