Malicious npm Packages Deploy Multi-Stage Trojan with Embedded GitLab Keys
Researchers at Positive Technologies have detailed a months-long campaign in which an attacker uploaded trojanized packages to the npm registry from five accounts: alex05255, mdrafiqulislamrabby, b.w1001, abdev8773 and mollspotwood54400.
The malicious packages are: svg-fetcher, tradepilot, polytrade, polymarket-kit, react-svg-chunk, gamified-trading-system, font-huge, font-hub, mdb-vite, router-processor and route-processor.
The first-stage code is lightly obfuscated and contains verbose explanatory comments that reveal its logic. It assembles the command-and-control address from multiple string constants and requests the next stage from http://svganchordev.net/icons/<token>, sending the value logo in the bearrtoken header.
Known stage versions are 106, 107, 108 and 116. The second stage is delivered as a single heavily obfuscated JavaScript line that, once formatted, collects the current username, computer name and operating-system details before opening a WebSocket connection to receive further commands.
Stages 106 and 116 contain an additional surprise: hardcoded public and private keys for a private GitLab instance hosted in the attacker’s own infrastructure. Although the keys cannot be used against external systems, their presence indicates that the actor maintains a CI/CD pipeline to automate obfuscation and publication of new stages.
Positive Technologies has reported all malicious packages to npm administrators and recommends that development teams integrate automated feeds from PT Fusion to detect supply-chain threats before they reach production environments.
Related articles
Supply Chain Attack Targets Arch Linux Community Repository
Arch Linux has temporarily suspended package adoptions in the Arch User Repository after detecting accounts taking over abandoned projects to insert malicious code. The platform later expanded the restriction by blocking all new submissions to the AUR to contain ongoing supply chain attacks. Attackers were adopting packages without active maintainers and introducing harmful changes through subsequent commits that could bypass user scrutiny due to established project history. Newly created packages containing malicious build commands, including requests for elevated privileges, were also discovered. Affected accounts have been banned and identified projects removed from the repository. The incident does not impact official Arch Linux repositories, with risk limited to community-maintained AUR packages that require manual review of PKGBUILD files before installation or updates.
How to Audit All Python Virtual Environments for Compromised Packages Without Executing Python
The article describes a practical workflow for discovering whether any Python virtual environments contain known malicious package versions. The author maintains a registry of all .venv directories across local disks and external volumes using find commands and shell hooks. A Bash script then iterates through the registry and runs uv pip freeze against each environment to list installed dependencies without invoking the Python interpreter. This approach avoids risks highlighted by recent supply-chain attacks on packages such as LiteLLM, where even python -V or pip freeze could trigger malicious .pth files. The method also supports locating outdated packages, identifying usage of deprecated libraries, and searching project code for specific functions. Configuration settings like PIP_REQUIRE_VIRTUALENV=true and the uv tool further prevent accidental global installations.
GitHub and PyPI Introduce Time-Based Defenses Against Supply Chain Attacks
GitHub and PyPI have activated new time-based barriers to slow down supply chain attacks. Dependabot now waits a default of 72 hours before proposing version updates, while PyPI rejects new files added to releases older than 14 days. The changes target non-security version updates and attempts to poison older stable releases. Security updates remain immediate, and the cooldown can be adjusted via dependabot.yml. The PyPI restriction, effective since July 8 2026, addresses risks from compromised tokens or CI/CD pipelines. Both platforms aim to give the community time to detect malicious packages before widespread adoption.
Container Image Risks: Why Skipping Verification Today Breaks Your Service Tomorrow
Technical leader Nikita from Cloud.ru details four recurring container security failures observed across client environments. The article examines untracked vulnerabilities in high-privilege components such as the NVIDIA GPU operator, supply-chain compromises affecting even trusted tools like Trivy, persistent secret leakage patterns, and CI/CD pipeline exposure. Real incidents include a 2025 NVIDIA container toolkit exploit that enabled lateral movement to worker nodes and a 2026 Trivy GitHub compromise that poisoned over seventy image tags. The author stresses that pinning to image tags is insufficient and recommends full SHA256 hashes, private registries with caching, Cosign signatures validated by Kyverno or Connaisseur, and pre-commit secret scanning. Practical recommendations include automated CVE notifications and immediate patching of privileged components rather than waiting for sprint cycles.