Sonatype Security Research Team
2024 Sonatype Blog

Atomic Arch npm Campaign Adds Malicious Dependency

Atomic Arch npm Campaign Adds Malicious Dependency

| | Sonatype Research
TL;DR Sonatype researchers uncovered Atomic Arch, a new campaign targeting orphaned packages in the Arch User Repository in which attackers take over legitimate, abandoned AUR projects and modify PKGBUILDS to install a malicious npm package during installation. This is especially concerning because the trusted package itself may not look obviously ... Read More
2024 Sonatype Blog
Image with text "281 malicious package versions, Miasma Returns"

New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages

| | malicious code npm, Malware, Malware Analysis, npm, Security Research, Sonatype Guide, Supply Chain Attacks
TL;DR Sonatype Security Research is tracking a new Shai-Hulud Miasma wave with 281 malicious npm package versions that move beyond obvious preinstall and postinstall scripts in package.json. This variant abuses binding.gyp to trigger execution through node-gyp during npm install and can collect developer and CI/CD data, steals credentials, validates access, ... Read More
2024 Sonatype Blog
Image with text "Lazarus Group, Trust Abuse on npm" at center and a label of "breaking news" in the upper right-hand corner.

Lazarus Group’s Latest: Brandjacking Campaign on npm

| | malicious code npm, Malware, Malware Analysis, npm, Security Research, Sonatype Guide, Supply Chain Attacks
TL;DR Sonatype Security Research is tracking a Lazarus Group npm campaign using dozens of malicious packages to abuse developer trust and deliver follow-on payloads. The campaign goes beyond typosquatting, relying on brandjacking tactics like suffix addition, embedding, and version mimicry to make packages look ecosystem-adjacent. Analysis of buffer-utilities shows a ... Read More
2024 Sonatype Blog
Red Hat Cloud Services npm Packages Hijacked

Red Hat Cloud Services npm Packages Hijacked

| | malicious code npm, Malware, npm, red hat, Security Research, Sonatype Guide, Supply Chain Attacks
A new wave of malicious npm activity has been reported involving multiple packages in the legitimate @redhat-cloud-services namespace ... Read More
2024 Sonatype Blog
Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies

Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies

| | Malware, Malware Analysis, Sonatype Guide, Vulnerabilities
The latest malware campaign uncovered by Sonatype researchers involved 176 malicious npm packages, many published with the exact same version number: 99.99.99 ... Read More
2024 Sonatype Blog
Hijacked npm Package Attempts to Deliver PolinRider-Linked RAT

Hijacked npm Package Attempts to Deliver PolinRider-Linked RAT

| | embedded malicious code, malicious code npm, npm, open source risk, open-source malware, Sonatype Guide, Threat
Attackers do not need to wait for a CVE when they can publish directly into the build ... Read More
2024 Sonatype Blog
Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target

Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target

| | Malware, Malware Analysis, open-source malware, Security Research, sonatype intelligence, Supply Chain Attacks
Why bother hunting for a CVE when you can just publish malicious code straight into the software supply chain? That’s the story behind the latest wave of Shai-Hulud-related npm compromises, which recently hit the Ant Design (AntV) ecosystem and potentially exposed downstream developers to credential theft and remote code execution ... Read More
2024 Sonatype Blog
Image with text "Pytorch Lightning Compromised" with icon of a skull next to it

Malicious PyTorch Lightning Packages Found on PyPI

| | Malware, Malware Analysis, open-source malware, PyPI, pypi vulnerability, python
TL;DR Two malicious versions of the popular PyTorch Lightning package have been uploaded to PyPI following the publisher account’s compromise. Lightning versions 2.6.2 and 2.6.3 (tracked as sonatype-2026-002817) were published on April 30, 2026, containing embedded malicious code that gathers developer credentials and publishes infected package versions. If downloaded, these malicious ... Read More
2024 Sonatype Blog
Image with a skull icon alongside text "CanisterSprawl: Self-propagating malware on npm"

Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

| | Malware, Malware Analysis, npm, open-source malware, PyPI, Sonatype Guide, Supply Chain Attacks
TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised packages under hijacked credentials, abusing developer trust in open source ecosystems to spread. Impacted organizations should remove the ... Read More
2024 Sonatype Blog
Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses

Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses

| | Everything Open Source, Malware, Malware Analysis, open source management, open-source malware, Vulnerabilities
TL;DR Sonatype identified 21,764 open source malware packages in Q1 2026, bringing the total logged since 2017 to 1,346,867. npm accounted for 75% of malicious packages this quarter. Trojans dominated, with most activity focused on credential theft, host reconnaissance, and staged payload delivery. The quarter's defining pattern was trust abuse: ... Read More
2024 Sonatype Blog