Hackers drop 60 npm bombs in less than two weeks to recon dev machines – Source: www.csoonline.com

Threat actors have likely made off with sensitive host and network information from developers’ systems in a coordinated malware campaign, involving 60 malicious npm packages, that were live for just under two weeks.

According to a Socket discovery, these packages were distributed via three different npm accounts to execute stealthy post-install scripts during the “npm install” operations.

“The script targets Windows, macOS, or Linux systems, and includes basic sandbox‑evasion checks, making every infected workstation or continuous‑integration node a potential source of valuable reconnaissance,” Socket researcher Kirill Boychenko said in a blog post.

The scripts collected hostnames, internal and external IP addresses, DNS configurations, and user directory paths, transmitting this information to a Discord webhook controlled by the threat actor.

Malicious code suggests a focus on reconnaissance 

The payload code snippet shared by Socket in the blog reveals a sharp focus on reconnaissance over immediate damage. At the very core, the script is aimed at fingerprinting every system that installs the infected package.

“By harvesting internal and external IP addresses, DNS servers, usernames, and project paths, it enables a threat actor to chart the network and identify high‑value targets for future campaigns,” Boychenko added.

The payload script, which appears identical across all 60 malicious packages, suggesting a coordinated campaign, employed lightweight sandbox evasion tactics to avoid detection. These included checking for virtualization indicators like “systemd-detect-virt” and known usernames like “sandbox.” 

Boychenko cautioned that on continuous-integration (CI) servers, the leak could expose details such as private registry URLs and internal build paths, potentially accelerating a supply chain attack.

Socket said they had petitioned for the removal of all the packages from npm.

The accounts are now defunct

The first three malicious packages, “e-learning-garena,” “seatalk-rn-leave-calendar,” and “coral-web-be,” were released under the npm accounts bbbb335656, cdsfdfafd1232436437, and sdsds656565, respectively. Since then, all three accounts have gone on to publish twenty malicious packages each.

According to Socket, the first package emerged eleven days ago, and the most recent appeared only hours before the disclosure publication, confirming the operation was still underway at the time.

However, an npm search at the time of writing this article revealed that the accounts may have been taken off npm. None of the packages flagged in the Socket research could be traced with the search either.

While they were live on npm, the combined downloads were reported to have exceeded 3000, which Socket said would have given threat actors a “growing map of developer and enterprise networks” for future intrusions.

Multiple npm abuses discovered within days

npm, the go-to package for JavaScript, has turned into an attacker’s favorite for its unmatched reach into developer workflows and the ability to become a strong vector for large-scale supply chain attacks.

Earlier this week, Socket also discovered a collection of malicious npm packages, undetected within npm for over two years, that deploy attacks against widely-used JavaScript frameworks including React, Vue.js, Vite, Node.js, and the open-source Quill Editor.

Masquerading as harmless plugins and utilities, the malicious packages carried destructive payloads meant to corrupt data, wipe critical files, and crash systems. Since their upload, they’ve picked up over 6200 downloads, escaping detection and slipping into unsuspecting developer environments.

“The threat actor behind this campaign, using the npm alias xuxingfeng with a registration email 1634389031@qq[.]com, has published eight packages designed to cause widespread damage across the JavaScript ecosystem,” said Socket researcher Kush Pandya in a blog post. “Notably, the same account has also published several legitimate, non-malicious packages that function as advertised.”

Earlier this month, hackers were found abusing npm to target multi-language developers with typo-squatted packages containing stealer and RCE codes. Boychenko advised applying standard hygiene while managing dependencies from npm. He recommended using dependency-scanning tools to flag post-install hooks, hardcoded URLs, and unusually small tar archives, in addition to strengthening the development pipeline with automated security checks.