Nearly 800 npm Packages Hide a Dangerous RAT and Infostealer

Michael Miller · 2026-08-07

If you're a developer who relies on the npm registry for your projects, you might want to sit down for this one. A new campaign has been uncovered, and it's not messing around. Nearly 800 malicious packages have been published to the npm registry, and they're all designed to deliver a powerful cross-platform RAT (Remote Access Trojan) and infostealer to unsuspecting victims. That's not a typo. We're talking about a massive cluster of packages that can hit Windows, Mac, and Linux systems alike. If you've ever downloaded a package without double-checking its name or origin, this is the wake-up call you didn't know you needed. ### The Sneaky Trick Behind the Attack Here's where it gets interesting. According to OpenSourceMalware researcher Paul, these packages aren't using the usual, obvious tricks. Instead, they're leveraging something called "AI slop squatted" names. That's a fancy way of saying the package names are either randomly generated or cleverly designed to mimic legitimate ones through typo-squatting. Think about it like this: you're in a hurry, you need a specific library, and you type the name slightly wrong. Boom. You've just installed malware. It's a simple, yet devastatingly effective, method that preys on our habits as developers. ### What Does the Malware Actually Do? Once one of these packages is installed, the payload kicks in. It's not just a single function either. The malware is a two-in-one deal: - **A Remote Access Trojan (RAT):** This gives the attackers full control over your machine. They can see your screen, access your files, and even use your webcam if they want to get creepy. - **An Infostealer:** This component is all about grabbing your sensitive data. We're talking passwords, cookies, browser history, and even cryptocurrency wallets. Everything you thought was safe is suddenly up for grabs. For a developer, this is a nightmare scenario. Your machine likely holds credentials for production servers, private repositories, and maybe even client data. One bad install, and all of that is in the hands of a stranger. ### Why This Matters More Than Ever The npm registry is the backbone of modern JavaScript development. Millions of packages are downloaded every day, and we often trust the ecosystem without a second thought. That trust is exactly what attackers are banking on. Here's the thing: this isn't a tiny, isolated incident. With nearly 800 packages involved, the scale is huge. It shows that attackers are getting more sophisticated and more willing to invest time and effort into poisoning the well. ### How to Protect Yourself Right Now You don't need to panic, but you do need to be proactive. Here are a few practical steps you can take to keep your projects safe: - **Double-check every package name** before you install it. Look for subtle typos or unusual characters. - **Use a lockfile** (like package-lock.json) to ensure you're installing the exact versions you've already vetted. - **Regularly audit your dependencies** with tools like `npm audit` to catch known vulnerabilities. - **Consider using a private registry** or a proxy that filters out suspicious packages before they even reach your machine. ### The Bigger Picture This campaign is a stark reminder that open-source ecosystems are not immune to malicious activity. In fact, they're becoming prime targets because of their widespread use and the implicit trust we place in them. The researchers at OpenSourceMalware are doing a great job flagging these threats, but they can't catch everything. As developers, we need to take responsibility for our own security. That means staying informed, being cautious, and never assuming a package is safe just because it's popular or well-named. So, the next time you're about to run `npm install`, take a breath. Look at the package name. Verify the source. It might just save you from a world of pain. And honestly, that's the kind of habit that separates a good developer from a great one.