Skip to content
Threat Feed
Subscribe

Product

Npm

3 briefs RSS
critical advisory

Atomic Arch Campaign Leverages Orphaned AUR Packages for Linux Payload Deployment

The Atomic Arch campaign compromises orphaned Arch User Repository (AUR) packages, modifying their PKGBUILDs to install malicious npm/Bun dependencies like 'atomic-lockfile,' which deploy a Linux payload with credential harvesting, eBPF-based stealth, anti-debugging, and data exfiltration capabilities, impacting approximately 1,500 packages.

Arch User Repository +2 supply-chain-attack npm bun linux malware credential-harvesting eBPF rootkit +1
3r 14t 6i
high threat

Shai-Hulud Campaign Returns Targeting npm Maintainer Accounts

The Shai-Hulud campaign is back and targets maintainer accounts to publish malicious code directly into the software supply chain via npm, recently hitting the Ant Design (AntV) ecosystem and potentially exposing downstream developers to credential theft and remote code execution.

npm Shai-Hulud supply-chain credential-theft remote-code-execution
1r 2t
critical advisory

Compromised intercom-client npm Package Exfiltrates Credentials

A compromised version (7.0.4) of the intercom-client npm package was published using a compromised developer account, containing obfuscated JavaScript that executed during installation to harvest and exfiltrate credentials from the environment, as part of the 'Mini Shai-Hulud' supply chain campaign.

intercom-client +5 supply-chain credential-theft npm
2r 2t