SUPPLY CHAIN ATTACK COMPROMISES NPM PACKAGES TO SPREAD BACKDOOR MALWARE

Summary from the TLDR InfoSec newsletter

Attackers launched a "Scavenger" supply chain attack in July that hijacked popular npm packages, including "is" (2.8 million weekly downloads), through phishing from a typosquatted domain (npnjs.org). The malware installed cross-platform JavaScript backdoors with persistent command channels on Windows, macOS, and Linux, affecting users who updated to infected versions. Exploiting high-privilege maintainer accounts, attackers could compromise thousands of companies, with malware mostly undetected by antivirus solutions on VirusTotal.