Notifications
Clear all
Topic starter
02/08/2026 11:48 am
TL;DR: An analysis of the jsonspack campaign shows 27 malicious npm packages using silent loaders, multi-channel C2 delivery, and credential theft routines that target browsers, wallets, and .env secrets, according to Panther. The case underscores how package trust, not just install-time checks, now defines supply-chain risk.
NHIMG editorial — based on content published by Panther: jsonspack: Multi-Tenant Node.js RAT, DPRK Supply Chain Campaign
By the numbers:
- 27 confirmed malicious npm packages were published by eight distinct email accounts between 2026-03-18 and 2026-03-31.
- 3,739 total downloads were recorded across all 27 packages as of 2026-04-01.
- 15 were unpublished and no longer publicly accessible, but were recovered from an npm package mirror.
Questions worth separating out
Q: What breaks when malicious npm packages execute during CI/CD installs?
A: The main failure is that package installation becomes code execution inside a trusted build context.
Q: Why do malicious packages create NHI risk as well as AppSec risk?
A: Because the package often lands inside an environment that already holds credentials, API keys, and automation tokens.
Q: What do security teams get wrong about package provenance and trusted publishing?
A: They often assume provenance replaces older authentication paths automatically.
Practitioner guidance
- Instrument runtime dependency execution Log module require() activity, detached child process creation, and dynamic constructor-based evaluation in Node.js build and runtime environments.
- Treat package metadata as insufficient trust evidence Require additional approval for packages that mimic common libraries, reuse popular branding, or ship loader code that immediately hands control to another process.
- Reduce secret reach from developer and CI identities Scope tokens, .env access, and build credentials so a compromised package cannot reach more than the minimum necessary secrets or files.
What's in the full report
Panther's full analysis covers the operational detail this post intentionally leaves for the source:
- Campaign attribution and clustering logic across the 27 malicious npm packages, including how the shared author metadata was used to correlate activity.
- Loader-level source excerpts for each variant, including the require()-triggered child process pattern and the inline IIFE exception.
- Decoded stage-3 payload analysis, including the browser credential, wallet, file exfiltration, and reverse shell components.
- Detection logic examples and telemetry-based rules for identifying the campaign in enterprise environments.
👉 Read Panther's analysis of the jsonspack npm supply chain campaign →
jsonspack supply chain campaign: what teams need to know now?
Explore further
02/08/2026 12:58 pm
Package trust has become a non-human identity problem. npm packages, build jobs, and loader processes now behave like identities with access, but many programmes still treat them as software artefacts rather than governed actors. That gap matters because the package may not be malicious at publish time, yet still execute malicious code at runtime. The governance conclusion is simple: if a dependency can execute and reach secrets, it needs identity-style control boundaries, not only provenance checks.
A few things that frame the scale:
- 28.65 million new hardcoded secrets were detected in public GitHub commits in 2025 alone, a 34% year-over-year increase and the largest single-year jump ever recorded, according to The State of Secrets Sprawl 2026.
- 64% of valid secrets leaked in 2022 are still valid and exploitable today, proving that detection alone is not enough without automated revocation, according to The State of Secrets Sprawl 2026.
A question worth separating out:
Q: How should organisations respond when a developer package is confirmed malicious?
A: Contain the affected hosts, identify every system that imported the package, and revoke any credentials that may have been accessible in those environments. Then review browser profiles, CI runners, and local files for secondary theft. The immediate goal is to remove the attacker’s reuse path before they pivot from the package to wider identity abuse.
👉 Read our full editorial: jsonspack supply chain campaign exposes npm loader and secret theft
