Recent findings by the Socket Threat Research Team reveal a growing trend of threat actors uploading malicious packages to npm and PyPI, disguised as legitimate developer tools. These packages, active between 2021 and 2024, target cryptocurrency secrets such as mnemonic seed phrases and private keys. The discovery highlights ongoing risks in open-source software supply chains, where attackers exploit trust in widely used repositories.
Key Incidents and Tactics
Attackers have deployed multiple techniques to evade detection while stealing sensitive data. Packages like react-native-scrollpageviewtest, web3x, and herewalletbot impersonate popular libraries but contain hidden credential-stealing functionality. Some exfiltrate data via Google Analytics or Telegram bots, while others use DNS queries to external domains like oastify.com for command-and-control (C2) communication1.
North Korean threat actors, including the Kimsuky group, have been linked to these campaigns. They exploit vulnerabilities such as BlueKeep (CVE-2019-0708) and CVE-2017-11882 in MS Office to deploy infostealers like KimaLogger and MySpy. Some npm packages, such as execution-time-async, were distributed through fake job recruitment schemes targeting developers2.
Technical Analysis
Malicious packages employ several evasion techniques:
- Obfuscation: Code is often split into fragments (e.g.,
require('b' + 'u' + 'f' + 'f' + 'e' + 'r')) to bypass static analysis. - Test Code Smuggling: Malware is hidden in test files to avoid scrutiny during code reviews.
- Legitimate Service Abuse: Some packages repurpose Google Analytics domains to bypass security controls.
One notable case involved the PyPI package django-log-tracker, which was dormant since 2022 before being updated with malicious code in 2025. The package downloaded Updater.exe from a hardcoded IP, later flagged by multiple antivirus vendors3.
Mitigation Strategies
Organizations can reduce risk through proactive measures:
- Verify Package Authenticity: Check maintainer history, GitHub links, and download counts before installation.
- Use Security Tools: Solutions like Socket.dev or Datadog’s GuardDog can detect suspicious dependencies.
- Monitor Network Traffic: Unusual outbound connections to analytics services may indicate compromise.
According to Sonatype, over 512,000 malicious packages were detected in 2024 alone, underscoring the scale of the problem4.
Conclusion
Supply chain attacks via npm and PyPI continue to evolve, with attackers refining obfuscation and social engineering tactics. Developers and security teams must remain vigilant, adopting automated scanning and strict dependency review processes. The rise of AI tool impersonation (e.g., fake deepseekai packages) further complicates detection, requiring updated defensive strategies.