Another wave of NPM Hack.

Documentation for the npm registry, website, and command-line interface

✓ Domain spoofing protection helps detect impersonation risks after a TanStack npm supply-chain attack exposed how developer credentials can become a threat.

A massive security breach has rocked the open-source ecosystem after hackers compromised widely used JavaScript libraries

NPM Supply Chain Massive Security Breach

Socket Research Team detected an active supply-chain attack via a brand‑squatted unscoped tanstack package on npm whose postinstall scripts in versions 2.0.4–2.0.7 silently collect and exfiltrate environment files (.env, .env.local, .env.production) to an attacker-controlled Svix ingest endpoint. The campaign is tied to npm author sh20raj and Svix source src_3387PLMB2uhXOBe3Q8sHu; Socket recommends uninstalling affected versions, rotating secrets, and blocking the unscoped tanstack package in registries. #tanstack #src_3387PLMB2uhXOBe3Q8sHu

A new supply chain attack targeting the npm ecosystem has compromised multiple Namastex Labs packages to steal developer credentials and secrets while attempting to self-propagate. Researchers from Socket and StepSecurity observed credential theft, data exfiltration, and worm-like republishing behavior similar to TeamPCP's CanisterWorm, impacting packages such as pgserve and allowing cross-ecosystem spread to PyPI. #NamastexLabs #npm #CanisterWorm #pgserve #PyPI

The author built a proof-of-concept AI-driven monitor that diffs package releases and flagged a malicious npm compromise of Axios that used a phantom dependency with a postinstall hook to deploy cross-platform malware. The incident ties into a wider supply-chain campaign (Trivy → LiteLLM → Telnyx → Axios) attributed to TeamPCP, prompting coordinated detection, takedown, and recommendations for registry monitoring and release soak times. #Axios #TeamPCP

Attackers published compromised Axios releases (axios@1.14.1 and axios@0.30.4) that introduced a trojanized dependency plain-crypto-js@4.2.1, which uses a postinstall dropper to deliver platform-specific payloads and a macOS Mach-O RAT capable of command execution, data collection, and persistence. Socket and other researchers tracked the C2 to sfrclak[.]com, identified additional tainted packages and vendor chains, and have recommended revoking tokens, checking lockfiles, and rolling back affected versions. #Axios #plain-crypto-js

On March 31, 2026, an attacker hijacked an axios npm maintainer account and published malicious releases (axios@1.14.1 and 0.30.4) that added a typosquatted dependency plain-crypto-js which executed a cross-platform RAT during npm install. The compromise was active for about three hours before npm removed the packages; the RAT communicated with C2 sfrclak[.]com and delivered macOS, Windows, and Linux payloads (all containing bugs), while maintainers and npm revoked tokens and mitigations followed. #axios #plain-crypto-js

Socket’s Threat Research Team uncovered a worm-enabled npm supply chain attack that compromised legitimate publisher namespaces including @emilgroup and @teale.io, replacing package contents with a Python implant that polls an ICP canister for rotatable second-stage payloads. The campaign, dubbed CanisterWorm, uses postinstall hooks, a systemd --user persistent service named pgmon, and a deploy.js republishing worm that leverages npm publishing tokens (often published with --tag latest) to propagate. #CanisterWorm #EmilGroup

JavaScript packages compromised! Learn about the NPM supply chain attack and how it exposed users to backdoor malware.

Explore a sophisticated npm attack revealing software supply chain vulnerabilities and the need for enhanced security measures.

would be shared in a professional relationship setting read more about Grafana GitHub Breach Exposes Source Code via TanStack npm Attack