{"id":3790,"date":"2026-04-06T17:27:22","date_gmt":"2026-04-06T17:27:22","guid":{"rendered":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/04\/06\/bad-actor-drops-36-malicious-packages-in-npm-targets-guardarian-users\/"},"modified":"2026-04-06T17:27:22","modified_gmt":"2026-04-06T17:27:22","slug":"bad-actor-drops-36-malicious-packages-in-npm-targets-guardarian-users","status":"publish","type":"post","link":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/2026\/04\/06\/bad-actor-drops-36-malicious-packages-in-npm-targets-guardarian-users\/","title":{"rendered":"Bad Actor Drops 36 Malicious Packages in npm, Targets Guardarian Users"},"content":{"rendered":"
\"threat<\/div>\n

\"threat<\/p>\n

The npm code repository<\/a> is again being used by a bad actor to launch a supply chain attack that includes three dozen malicious packages that appear as Strapi CMS plugins but deliver a range of threats.<\/p>\n

Strapi is a popular open source headless Node.js content management system developers use to build, manage, and expose content through REST or GraphQL APIs while using a range of front-end frameworks, like React<\/a>, Next.js, and Vue. Capabilities that make it attractive include a customizable administrator panel and flexibility in databases developers can use.<\/p>\n

According to researchers with cybersecurity vendor SafeDep, the 36 malicious packages were published using four npm accounts, with varying numbers of packages in each account.<\/p>\n

\u201cContrary to what you might expect from a package-spam campaign, the analyzed packages carry\u00a0different payloads\u00a0\u2014 eight distinct variants in total \u2014 revealing a real-time attack development session against a specific target,\u201d researchers with cybersecurity vendor SafeDep wrote in a report<\/a>. \u201cThis campaign is a rare window into an attacker\u2019s real-time development process. Over 13 hours, the operator published ten packages with eight distinct payloads, each iteration responding to what was likely working (or not) against their target.\u201d<\/p>\n

Multiple Threats<\/h3>\n

The payloads carry a range of threats with them, from Redis remote code execution (RCE) and PostgreSQL exploitation to Docker and Kubernetes container escape, credential harvesting \u2013 such as passwords, SSH private keys, and cryptocurrency wallet information \u2013 persistence, and Python reverse shell deployment.<\/p>\n

\u201cEvery package contains three files (package.json,\u00a0index.js,\u00a0postinstall.js), has no description, repository, or homepage, and uses version 3.6.8 to appear as a mature Strapi v3 community plugin,\u201d the researchers wrote. \u201cThe package names follow the naming convention used by legitimate packages like\u00a0strapi-plugin-comments\u00a0or\u00a0strapi-plugin-upload. All official Strapi plugins are scoped under\u00a0@strapi\/, making these unscoped names a social engineering choice targeting developers searching for community plugins.\u201d<\/p>\n

The attacker\u2019s malicious code is found in the postinstall file script, which is different for each package. It is executed on \u201cnpm install\u201d through the postinstall script, without any interaction from the user being needed. It includes the privileges for the installing user, which in CI\/CD environments and Docker containers means root access.<\/p>\n

Guardarian is the Target<\/h3>\n

The campaign appears to target Guardarian, a European Union-based cryptocurrency gateway that allows users to buy, sell, and swipe more than 1,000 cryptocurrencies. From the first payload onward, Guardarian references are found.<\/p>\n

This confirmed that \u201cthis was a targeted campaign against a cryptocurrency payment platform from the very beginning \u2014 not an opportunistic spray that became targeted over time,\u201d they wrote. \u201cThe hardcoded database password in Payload 6 proves this is not the attacker\u2019s first interaction with the target\u2019s infrastructure.\u201d<\/p>\n

Multiple Packages Over 13 Hours<\/h3>\n

The SafeDep researchers were able to track the packages published over a 13-hour period. The first hour involved the two payloads that came with Redis RCE exploitation, with crontab injection, SSH key injection, and other capabilities.<\/p>\n

That was followed over the intervening hours by payloads with simplified direct reverse shells and then reconnaissance to collect credentials and secrets for future use, direct database exploitation using hardcoded PostgreSQL credentials to grab Strapi data, probing for Guardarian payment.<\/p>\n

Hours 10 through 13 were focused on persistent access, with the bad actor switching to a second npm account and deploying persistent implants and armed with the target\u2019s hostname, CI\/CD pipeline, and secrets directory layout.<\/p>\n

\u201cThe eight payloads show a clear narrative: the attacker started aggressive (Redis RCE, Docker escape), found those approaches weren\u2019t working, pivoted to reconnaissance and data collection, used hardcoded credentials for direct database access, and finally settled on persistent access with targeted credential theft,\u201d they wrote.<\/p>\n

Rotate Credentials<\/h3>\n

Developers who installed any of the malicious packages need to assume they\u2019ve been compromised and rotate credentials \u2013 database passwords, API keys, JWT secrets, and private keys, among others \u2014 that are stored on their system.<\/p>\n

The campaign is only the latest in a growing trend of dropping malicious packages into code repositories to initiate supply chain attacks. Sonatype researchers wrote that throughout last year, they identified more than 454,600 such malicious packages<\/a>, bringing the total of known and blocked malware to more than 1.233 million packages not only in npm but also PyPI, Maven Central, NuGet, and Hugging Face.<\/p>\n

\u201cThis year, we observed that the evolution of open source malware crystallized, evolving from spam and stunts into sustained, industrialized campaigns against the people and tooling that build software,\u201d they wrote, adding that both the scale and sophistication of the threat grew in 2025.<\/p>\n

More than 99% of open source malware last year was found on npm. State-linked threat actors like North Korea\u2019s Lazarus Group<\/a> was able to plant five-stage payload chains that included droppers, credential theft, and persistent remote access, while Shai-Hulud<\/a> \u201cproved that open source malware can now propagate autonomously through open source ecosystems,\u201d they wrote.<\/p>\n

Read More<\/a><\/p>\n

\u200b<\/p>","protected":false},"excerpt":{"rendered":"

The npm code repository is again being used by a bad actor to launch a supply chain attack that includes […]<\/p>\n","protected":false},"author":1,"featured_media":3791,"comment_status":"","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[5],"tags":[],"class_list":["post-3790","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-devops"],"_links":{"self":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/3790","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/comments?post=3790"}],"version-history":[{"count":0,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/posts\/3790\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media\/3791"}],"wp:attachment":[{"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/media?parent=3790"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/categories?post=3790"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/rssfeedtelegrambot.bnaya.co.il\/index.php\/wp-json\/wp\/v2\/tags?post=3790"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}