Re:Self Propagating NPM Malware Compromises over 40 Packages
by advocatemack on Tuesday September 16, 2025 @10:48AM
(#45263064)
Mackenzie here I work for Aikido.
This is a classic example of the security community all playing a part. The very first notice of this was from a developer named Daniel Pereira. He alerted Socket who did the first review of the Malware and discovered 40 packages. After, Aikido discovered an additional 147 packages and the Crowdstrike packages.
I'm not sure how Step found it but they were the first to really understand the malware and that it was a self replicating worm. So multiple parties all playing a part kinda independent. Its pretty cool
[ Parent
| on HN ]
Re:Self Propagating NPM Malware Compromises over 40 Packages
by sauercrowd on Tuesday September 16, 2025 @06:27PM
(#45269054)
question how does your product help in these situations? I imagine it'd require for someone to report a compromised package, and then you guys could detect it in my codebase?
Re:Self Propagating NPM Malware Compromises over 40 Packages
by singulasar on Wednesday September 17, 2025 @06:25AM
(#45273990)
Yes to the you guys can detect it in my codebase, but it's generally not required for someone to report a compromised package, we do also discover them ourselves quite fast due to automated scans of npm package updates. This is how aikido was first to discover the previous supply chain hack.
The easiest way for you to use our product to be protected is actually using one of our free open source tools. https://www.npmjs.com/package/@aikidosec/safe-chain
This is a wrapper around npm etc that will prevent you from installing malware