npm

hyatt-avatar

hyatt-avatar is identified in the SafeDep analysis "Malicious npm Packages Impersonating Hyatt Internal Dependencies". Three malicious npm packages disguised as Hyatt internal dependencies were discovered using install hooks to execute malicious payloads. All packages share identical attack patterns and infrastructure.

discovered 2025-10-23

Threat types

typosquat

Malicious versions

  • 999.999.999

Campaigns

Indicators

Techniques

Read the full analysis →