How vulnerable are software developers to sophisticated supply chain attacks targeting their most trusted tools? Recent findings reveal that cybercriminals are exploiting developer workflows through malicious packages distributed via npm repositories and VS Code extensions, demonstrating the growing sophistication of attacks against software development environments.
Socket security researchers identified 60 malicious npm packages during the week of May 23, 2025, which collectively harvested system data from over 3,000 downloads before removal. The packages were published under three accounts—bbbb335656, cdsfdfafd1232436437, and sdsds656565—with each account releasing approximately 20 packages within an 11-day period starting May 12, 2025.
Sixty malicious npm packages from three suspicious accounts harvested data from over 3,000 downloads in an 11-day coordinated campaign.
These malicious packages targeted Windows, macOS, and Linux systems through cross-platform compatibility designed to maximize infection reach. Zero-day exploits are increasingly common in such supply chain attacks, putting developers at significant risk.
The attack employed sophisticated evasion techniques, triggering malicious code through post-install scripts during the installation process while precisely fingerprinting machines. The malware aborted execution when detecting virtualized environments from Amazon, Google, and other cloud providers, demonstrating advanced sandbox-evasion capabilities. Attackers implemented obfuscation techniques to hide malicious functionality and evade detection during code review processes.
Researchers observed no second-stage payloads, privilege escalation, or persistence mechanisms during initial analysis.
Stolen data was transmitted to attacker-controlled Discord webhook endpoints, including hostnames, IP addresses, DNS servers, user directories, working directories, usernames, and network interface card information. Both internal and external IP addresses were targeted for exfiltration, providing attackers thorough system reconnaissance data.
The campaign extended beyond npm packages to include VS Code extensions, targeting developer environments, cryptocurrency wallets, and developer credentials. A separate attack in May 2025 infected approximately 3,200 Cursor users on Apple macOS with backdoors, while another related campaign targeted Microsoft O365 credentials through phishing techniques. Threat actors have increasingly turned to AES encryption methods to obfuscate malicious payloads and evade detection systems.
Attackers used deceptive distribution methods, employing names similar to legitimate packages and generic trust-evoking names to appear legitimate. Some package names hinted at testing functionality, potentially targeting continuous-integration and continuous-deployment pipelines.
This campaign represents part of a broader pattern, following a similar January 2025 attack involving packages named serve-static-corell, openssl-node, and next-refresh-token that communicated with centralized command-and-control servers.
Security experts recommend immediate removal of suspicious packages, thorough system scans, and increased vigilance when installing packages from npm repositories.
