Security researchers have identified 60 malicious packages in the NPM registry that collect sensitive host and network information, exfiltrating it to Discord webhooks controlled by threat actors. The campaign, active as of May 2025, targets CI/CD pipelines and developer environments, with over 3,000 downloads recorded before detection1. This incident highlights ongoing risks in open-source software supply chains, particularly in widely used platforms like NPM.
Key Findings and Technical Details
The malicious packages, including flipper-plugins and react-xterm2, were uploaded by three NPM accounts (bbbb335656, sdsds656565, and cdsfdfafd1232436437). Post-install scripts execute reconnaissance, gathering:
- Hostnames and internal/external IP addresses
- User home directories and usernames
- DNS server configurations
Data is sent to Discord webhooks (e.g., hxxps://discord[.]com/api/webhooks/133001505...) while avoiding sandboxed environments like AWS or GCP instances2. The packages were discovered by Socket.dev, which petitioned NPM for their removal.
Historical Context and Industry Trends
This campaign follows patterns observed in previous attacks:
| Year | Campaign | Tactics |
|---|---|---|
| 2024 | Crypto Typosquatting | 100+ packages mimicking cryptocurrency libraries |
| 2023 | Operation Brainleeches | Phishing via fake Microsoft 365 login forms |
| 2022 | IconBurst | Form-jacking through typosquatted modules |
Recent attacks show a shift toward reconnaissance for future operations rather than immediate payload delivery3.
Mitigation and Detection
Organizations should:
- Audit dependencies using tools like Socket or ReversingLabs A1000
- Monitor network logs for connections to suspicious IPs (e.g., 137.184.153.238)
- Implement Software Composition Analysis (SCA) solutions
Blockquote from Socket.dev researchers:
“The use of Discord webhooks for exfiltration demonstrates attackers’ preference for legitimate services to bypass detection.”2
Conclusion
This incident underscores the need for proactive monitoring of software dependencies. As attackers evolve tactics, maintaining updated threat intelligence and implementing layered defenses remains critical for supply chain security.
References
- “Dozens of malicious packages on NPM collect host and network data,” BleepingComputer, May 2025. [Online]. Available: https://www.bleepingcomputer.com/news/security/dozens-of-malicious-packages-on-npm-collect-host-and-network-data
- “60 malicious NPM packages leak network and host data,” Socket.dev, May 2025. [Online]. Available: https://socket.dev/blog/60-malicious-npm-packages-leak-network-and-host-data
- “Operation Brainleeches: Malicious NPM packages fuel supply chain and phishing attacks,” ReversingLabs, 2023. [Online]. Available: https://www.reversinglabs.com/blog/operation-brainleeches-malicious-npm-packages-fuel-supply-chain-and-phishing-attacks
