T1098
Account Manipulation
discovered 2025-09-16Compromised npm maintainer accounts across 6+ organizations (jaredwray, sitthidet_arv, onereach.user, qlikossbuild, st-team, multiple @deliveroo accounts) used simultaneously for mass publishing.
View on MITRE ATT&CKSeen in packages
- npm @ctrl/tinycoloruses
- npm @zapier/zapier-sdkuses
- npm @asyncapi/specsuses
- npm @quick-start-soft/quick-markdown-printuses
- npm @quick-start-soft/quick-markdownuses
- npm @quick-start-soft/quick-remove-image-backgrounduses
- npm @quick-start-soft/quick-git-clean-markdownuses
- npm @quick-start-soft/quick-document-translatoruses
- npm @quick-start-soft/quick-markdown-imageuses
- npm @quick-start-soft/quick-task-refineuses
- npm @asyncapi/modelinauses
- npm posthog-react-nativeuses
- npm posthog-nodeuses
- npm @postman/secret-scanner-wasmuses
- npm @postman/csv-parseuses
- npm @postman/node-keytaruses
- npm @postman/tunnel-agentuses
- npm @postman/wdio-allure-reporteruses
- npm @postman/postman-mcp-cliuses
- npm @postman/mcp-ui-clientuses
- npm @postman/wdio-junit-reporteruses
- npm @postman/pm-bin-macos-arm64uses
- npm @postman/pm-bin-linux-x64uses
- npm @postman/aether-iconsuses
- npm @fairwords/websocketuses
- npm @fairwords/loopback-connector-esuses
- npm @fairwords/encryptionuses
- npm @cap-js/sqliteuses
- npm @cap-js/postgresuses
- npm @cap-js/db-serviceuses
- npm mbtuses
- pypi pytorch-lightninguses
- npm common-tg-serviceuses
- pypi durabletaskuses
- npm @redhat-cloud-services/patch-clientuses
- npm weavedb-sdkuses
