July 2025 – A concerning cybersecurity development is currently unfolding, and it may impact businesses that rely on open-source packages, particularly those using the NPM (Node Package Manager) ecosystem. Cybersecurity firm Socket has identified a coordinated campaign involving dozens of malicious packages published to NPM, each designed to steal system information from developers and organizations during software installation.
Malicious Code Hidden in NPM Packages
Over the past two weeks, a threat actor has uploaded at least 60 malicious packages to the NPM registry. These packages contain a stealthy script that executes during installation, targeting systems running Windows, Linux, and macOS.
Once triggered, the script quietly collects:
- Hostnames
- IP addresses (internal and external)
- DNS server configurations
- Directory paths
- Usernames
The stolen data is exfiltrated to a Discord webhook controlled by the attacker.
What makes this campaign particularly troubling is its evasion techniques and system fingerprinting capabilities. The script includes basic sandbox detection methods to avoid analysis and was crafted specifically to map the networks of developers and businesses that unknowingly install these packages.
Real-World Impact and Growing Risk
According to Socket’s advisory, these malicious packages have already been downloaded more than 3,000 times, giving the threat actor visibility into a broad range of development environments. This exposure provides them with the opportunity to plan more targeted and damaging intrusions.
The packages were published using three NPM accounts—bbbb335656, cdsfdfafd1232436437, and sdsds656565—with each account uploading 20 packages. Despite the alarm raised by Socket, all packages remain live on NPM as of this writing, and efforts are underway to have them removed.
Why This Matters to Your Business
This campaign poses serious risks for any organization involved in software development or that relies on external code dependencies. The stolen data allows threat actors to link private, internal systems with outward-facing infrastructure, effectively providing a blueprint of your network. This opens the door to:
- Follow-up intrusions
- Supply chain attacks
- Targeted campaigns against high-value assets
As Socket explains, the information collected could expose internal registry URLs, build paths, and other metadata that is valuable to attackers planning the next phase of an attack.
What You Can Do
If your organization develops or deploys Node.js applications, it’s critical to take proactive steps now. Here are some best practices to reduce your risk:
- Use dependency scanning tools to monitor for:
Small or suspiciously lightweight tarballs
Hardcoded external URLs
Post-install hooks that may trigger unwanted scripts - Small or suspiciously lightweight tarballs
- Hardcoded external URLs
- Post-install hooks that may trigger unwanted scripts
- Audit recent NPM installations to identify any connections to the flagged packages or suspicious behaviors during install.
- Isolate build environments to prevent accidental exposure of sensitive system data to malicious packages.
- Report suspicious packages directly to NPM and the security community.
- Consider a private package registry or vetted package sources to reduce reliance on untrusted third-party uploads.