Malicious npm Packages Used to Spy on Developer Networks
May 23, 2025
The npm registry is under fire again after researchers at Socket uncovered a coordinated malware campaign targeting developer environments.
At least 60 malicious packages from three suspicious npm accounts were found to contain identical host-fingerprinting scripts, designed to map internal developer networks. These packages have already been downloaded over 3,000 times.
Rather than causing immediate harm, the malware gathers data like internal URLs and build paths, especially from CI servers, laying the groundwork for future supply chain attacks.
The attackers used similar email addresses and a shared Discord webhook for exfiltrating data. The use of post-install scripts, a legitimate npm feature, enabled the malicious code to run unnoticed.
Socket warns the campaign is still active, and expects attackers to create new throwaway accounts, reuse the script, and push more malicious packages unless npm takes action.
Developers are urged to:
Use dependency scanners to detect post-install hooks and suspicious code
Be cautious with unfamiliar or small-sized packages
Integrate automated security checks into their pipelines
The message is clear: securing the software supply chain requires constant vigilance.
|
|
|
Sign Up to
Our Newsletter!
Get the latest news in tech.
|
|
|
