Malware Analysis

Image with text "281 malicious package versions, Miasma Returns"

New Shai-Hulud Miasma Wave Hits Hundreds of npm Packages

| | malicious code npm, Malware, Malware Analysis, npm, Security Research, Sonatype Guide, Supply Chain Attacks
TL;DR Sonatype Security Research is tracking a new Shai-Hulud Miasma wave with 281 malicious npm package versions that move beyond obvious preinstall and postinstall scripts in package.json. This variant abuses binding.gyp to ...
2024 Sonatype Blog
Image with text "Lazarus Group, Trust Abuse on npm" at center and a label of "breaking news" in the upper right-hand corner.

Lazarus Group’s Latest: Brandjacking Campaign on npm

| | malicious code npm, Malware, Malware Analysis, npm, Security Research, Sonatype Guide, Supply Chain Attacks
TL;DR Sonatype Security Research is tracking a Lazarus Group npm campaign using dozens of malicious packages to abuse developer trust and deliver follow-on payloads. The campaign goes beyond typosquatting, relying on brandjacking ...
2024 Sonatype Blog
Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies

Inside a 176-Package npm Campaign Built to Beat Your Internal Dependencies

| | Malware, Malware Analysis, Sonatype Guide, Vulnerabilities
The latest malware campaign uncovered by Sonatype researchers involved 176 malicious npm packages, many published with the exact same version number: 99.99.99 ...
2024 Sonatype Blog
Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target

Shai-Hulud is Back: Maintainer Accounts Are Still the Soft Target

| | Malware, Malware Analysis, open-source malware, Security Research, sonatype intelligence, Supply Chain Attacks
Why bother hunting for a CVE when you can just publish malicious code straight into the software supply chain? That’s the story behind the latest wave of Shai-Hulud-related npm compromises, which recently ...
2024 Sonatype Blog
Image with text "Pytorch Lightning Compromised" with icon of a skull next to it

Malicious PyTorch Lightning Packages Found on PyPI

| | Malware, Malware Analysis, open-source malware, PyPI, pypi vulnerability, python
TL;DR Two malicious versions of the popular PyTorch Lightning package have been uploaded to PyPI following the publisher account’s compromise. Lightning versions 2.6.2 and 2.6.3 (tracked as sonatype-2026-002817) were published on April ...
2024 Sonatype Blog
Image with a skull icon alongside text "CanisterSprawl: Self-propagating malware on npm"

Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

| | Malware, Malware Analysis, npm, open-source malware, PyPI, Sonatype Guide, Supply Chain Attacks
TL;DR An open source malware campaign dubbed CanisterSprawl has been observed in npm, stealing sensitive data from developer machines including tokens, API keys, and more. From there, the malware publishes additional compromised ...
2024 Sonatype Blog
Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses

Q1 2026 Open Source Malware Index: Adaptive Attacks, Familiar Weaknesses

| | Everything Open Source, Malware, Malware Analysis, open source management, open-source malware, Vulnerabilities
TL;DR Sonatype identified 21,764 open source malware packages in Q1 2026, bringing the total logged since 2017 to 1,346,867. npm accounted for 75% of malicious packages this quarter. Trojans dominated, with most ...
2024 Sonatype Blog

Axios Compromise on npm Introduces Hidden Malicious Package

| | malicious code npm, Malware, Malware Analysis, npm, open-source malware, Security Research, Sonatype Guide, Sonatype Research
A newly discovered software supply chain attack targeting the npm ecosystem briefly compromised one of the most widely used JavaScript libraries in the world ...
2024 Sonatype Blog
Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer

Compromised litellm PyPI Package Delivers Multi-Stage Credential Stealer

| | AI, LLMs, Malware, Malware Analysis, PyPI, python, Security Research, Sonatype Guide, Sonatype Research
This morning, the widely used Python package litellm, a popular abstraction layer for interacting with large language models (LLMs), was compromised and two malicious versions released (1.82.7 and 1.82.8) ...
2024 Sonatype Blog
Sonatype Discovers Two Malicious npm Packages

Sonatype Discovers Two Malicious npm Packages

| | malicious code npm, Malware, Malware Analysis, npm, NPM support, Security Research, Sonatype Guide
Sonatype Security Research has identified a potential compromise of a trusted npm maintainer account that has now published two malicious npm packages — sbx-mask and touch-adv — designed to exfiltrate secrets from ...
2024 Sonatype Blog
Load more