JFrog found malicious npm packages that deploy a Windows RAT to steal Chrome credentials, run commands, and transfer files.
Ravie LakshmananJun 23, 2026Supply Chain Attack / Developer Security
Cybersecurity researchers have discovered a set of malicious npm packages that are designed to deliver a Windows-based remote access trojan (RAT).
The list of identified packages, is below -
aes-decode-runner-pro (145 downloads)
postcss-minify-selector (256 downloads)
4 malicious npm packages with 3,006 downloads spread stealers and Phantom Bot, forcing removals and secret rotation.
Slowmist confirmed three malicious node-ipc npm versions on May 14, 2026, stealing AWS keys, SSH secrets, and .env files via DNS…
144 Mastra npm packages added easy-day-js malware, exposing developer systems and CI runners to infostealer risks.
Six-minute supply chain blitz pushed 84 malicious versions with credential theft and disk-wiping code
Multiple npm supply chain attacks used 50+ poisoned packages to spread IronWorm, a Rust-based stealer, and a Miasma worm variant.
Popular JavaScript modules including size-sensor and echarts-for-react hit as hijacked account closed GitHub warnings
