malware
npm
@ctrl/tinycolor
discovered 2025-09-16@ctrl/tinycolor is identified in the SafeDep analysis "npm Supply Chain Attack Exposes Private Repositories, AWS Credentials and More". npm supply chain attacks continue. This time targeting @ctrl/tinycolor and multiple other packages with credential stealer malware. In this blog, we will analyze the attack and its impact on the npm ecosystem. We will also look at common attack patterns that are being used to target maintainers.
Threat types
credential_stealer data_exfiltration
Malicious versions
- 4.1.1
Campaigns
Indicators
Techniques
- ttp T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Toolsuses
- ttp T1059.007 Command and Scripting Interpreter: JavaScriptuses
- ttp T1552.001 Unsecured Credentials: Credentials In Filesuses
- ttp T1041 Exfiltration Over C2 Channeluses
- ttp T1528 Steal Application Access Tokenuses
- ttp T1105 Ingress Tool Transferuses
- ttp T1071.001 Application Layer Protocol: Web Protocolsuses
- ttp T1102 Web Serviceuses
- ttp T1546 Event Triggered Executionuses
- ttp T1021 Remote Servicesuses
- ttp T1098 Account Manipulationuses
- ttp T1027 Obfuscated Files or Informationuses
