T1195.002
Compromise Software Supply Chain
discovered 2026-05-26Malicious commit to the next branch triggered the automated release workflow, publishing five poisoned @asyncapi npm package versions (~2.9M combined weekly downloads) to the public registry.
View on MITRE ATT&CKSeen in packages
- npm forge-jsxyuses
- npm forge-jsx4uses
- npm pino-zoduses
- npm zod-pinouses
- npm compose-logger-standuses
- npm zod-pino434uses
- npm zod-pino444uses
- npm zredis-typeduses
- npm pinokio-redisuses
- npm js-logger-packuses
- npm faster-axiosuses
- npm turbo-axiosuses
- npm weavedb-sdkuses
- pypi gpt-pilotuses
- npm atomic-lockfileuses
- npm js-digestuses
- npm @mastra/coreuses
- npm easy-day-jsuses
- npm procwireuses
- npm @withgoogle/stitch-sdkuses
- npm apintergrationpostuses
- npm @apexcraft/nano-keyuses
- npm @injectivelabs/sdk-tsuses
- npm nodemon-sudouses
- npm tslint-confuses
- npm nodemon-nodeuses
- npm jscrambleruses
Campaigns
- miasma-train-p1uses
- Pepesoftuses
- forge-jsx RATattributed-to
- Contagious Interviewattributed-to
- Epsilon Axios Typosquat Campaignattributed-to
- IronWormattributed-to
- Miasma: The Spreading Blightattributed-to
- Atomic Archattributed-to
- @mastra npm Scope Takeoverattributed-to
- procwire / deltajohnsons Windows Dropperattributed-to
- wshu.net npm Credential-Stealer Campaignattributed-to
- emiltype/jsonspackattributed-to
