Ghost campaign malicious npm supply-chain operation
Campaign
Summary
Hide ▲
Show ▼
A malicious npm supply-chain campaign dubbed "Ghost campaign" is using fake installation logs to conceal malware delivery, increasing the chance that package installers execute hidden payloads. The operation began in early February and relies on malicious packages with downloader functionality. Those packages prompt for a user's sudo password during installation and then use it to run a remote access trojan (RAT). The payload can steal crypto wallets and sensitive data while taking commands from a C2 server.
Related Happenings
Compromised @asyncapi npm packages distributing the Miasma loader
Malware Activity
H score29
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Compromised @asyncapi npm packages distributing the Miasma loader
Malware ActivityAbout this happening: Four compromised @asyncapi npm packages now deliver a multi-stage botnet loader when imported, exposing consumers to Miasma payloads during normal Node.js module load....
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware Activity
H score9
First: 11.07.2026 20:59
Last: 11.07.2026 20:59
Sources 1
About this happening:
The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware ActivityAbout this happening: The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
Rollup polyfill npm package malware activity for remote access and data theft
Malware Activity
H score16
First: 03.07.2026 19:07
Last: 03.07.2026 19:07
Sources 1
About this happening:
Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Rollup polyfill npm package malware activity for remote access and data theft
Malware ActivityAbout this happening: Malicious npm packages disguised as Rollup polyfill tooling are now delivering remote-access and data-theft payloads to developer workstations and build machines. The...
Deps credential stealer in hijacked Arch AUR builds
Malware Activity
H score3
First: 12.06.2026 22:24
Last: 12.06.2026 22:24
Sources 1
About this happening:
Atomic Arch is a malware activity that hijacked more than 400 Arch User Repository (AUR) packages on or after June 11 and rewrote their build scripts to run npm...
Deps credential stealer in hijacked Arch AUR builds
Malware ActivityAbout this happening: Atomic Arch is a malware activity that hijacked more than 400 Arch User Repository (AUR) packages on or after June 11 and rewrote their build scripts to run npm...
AUR package-hijacking campaign delivering atomic-lockfile
Campaign
H score11
First: 12.06.2026 20:03
Last: 12.06.2026 20:03
Sources 1
About this happening:
AUR package-hijacking campaign is abusing more than 400 compromised Arch User Repository (AUR) packages to deliver atomic-lockfile, turning the AUR build path...
AUR package-hijacking campaign delivering atomic-lockfile
CampaignAbout this happening: AUR package-hijacking campaign is abusing more than 400 compromised Arch User Repository (AUR) packages to deliver atomic-lockfile, turning the AUR build path...
Timeline
-
24.03.2026 16:30 2 articles · 3mo ago
Ghost campaign identified in malicious npm packages
Initial DisclosureReversingLabs identified a malicious npm supply-chain campaign dubbed the Ghost campaign against npm users and package installers. The packages mimicked legitimate installation activity with fake npm install logs, downloader behavior, and prompts for a sudo password, then used the stolen password to execute a remote access trojan capable of stealing crypto wallets and sensitive data.
Show sources
- New Npm 'Ghost Campaign' Uses Fake Install Logs to Hide Malware — www.infosecurity-magazine.com — 24.03.2026 16:30
- New Npm 'Ghost Campaign' Uses Fake Install Logs to Hide Malware — www.infosecurity-magazine.com — 24.03.2026 16:30