Malicious npm Packages Hide Payloads in Install Steps
The trap is not the fake package name. It is the install-time code and second-stage dependency chain, which lets the payload run before a quick review of the top-level package or registry cleanup ever sees it. That gives attackers a window to take developer secrets during normal npm installs.
JFrog tied six removed npm packages to a North Korea-linked campaign. The lookalike packages mimicked Rollup polyfill tooling, then pulled in staged packages that fetched and executed the real malware from a remote JSON service, with checks to avoid sandboxes and cloud dev environments.
For teams that install third-party npm packages in CI or on developer workstations, the risk is credential theft from a package tree that looks harmless until the install finishes. Rotating secrets matters because the dangerous part can already have run.