Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

Researchers at OpenSourceMalware have identified a cluster of nearly 800 malicious packages published to the npm registry as part of a coordinated campaign delivering cross-platform malware capable of targeting Windows, macOS, and Linux systems.

What Was Reported

According to researcher Paul at OpenSourceMalware, the packages use naming patterns consistent with AI-generated slop-squatting and randomly generated typosquatting names. Despite the variation in naming, all identified packages reportedly deliver the same payload: a remote access trojan (RAT) combined with an infostealer component. Full technical details on the malware's specific capabilities, C2 infrastructure, and exact package names had not been comprehensively published at the time of this writing.

Why It Matters

npm-based supply chain attacks at this scale pose risk to any organization or individual developer who installs packages without careful vetting — a single typo or reliance on an AI coding assistant suggesting a plausible-but-wrong package name could result in code execution across any of the three major desktop operating systems. Because the payload combines remote access with credential/data theft, successful compromise could lead to both persistent access and downstream credential exposure (source control, cloud, CI/CD secrets), extending impact well beyond the initial developer machine.

What Defenders Should Watch For

• Audit recent npm install activity and CI/CD logs for unfamiliar or newly-added dependencies, especially those with low download counts, no repository link, or names that closely resemble popular packages.
• Review lockfiles (package-lock.json, yarn.lock) for unexpected additions and diff dependency trees before merging.
• Monitor endpoint telemetry for post-install script execution (npm preinstall/postinstall hooks) spawning unexpected child processes, especially those reaching out to unfamiliar network destinations shortly after a package install.
• Watch for outbound connections from developer workstations and build agents that don't match known package registries or CI infrastructure, which could indicate RAT check-in or infostealer exfiltration.
• Consider enforcing dependency allowlists, package-signing verification, or a private registry proxy with vetting for high-value environments (build systems, CI runners).
• Where available, cross-reference installed package names against known typosquat/slopsquat lists as they are published by the security community.

Developing Story

This is a net-new, actively developing report and full indicators of compromise (specific package names, hashes, C2 infrastructure) were not yet fully detailed in initial coverage. Defenders should treat the scale and cross-platform nature of this campaign as a reminder to tighten dependency-vetting practices generally, and should follow the original reporting for updates as more details emerge. Read the full report at The Hacker News.