Artifact scanner detects npm package 'node-fetch-utils' using external dependency resolution with remote tarball dependency from GitHub

A malicious npm package named 'node-fetch-utils' was discovered masquerading as a legitimate fetch helper utility. The package declares a remote tarball dependency from GitHub that executes upon installation. It runs an obfuscated postinstall script targeting Windows systems, which downloads a bundled Python runtime and drops it as Microsoft\EdgeBroker\pythonw.exe for persistence. The dropper then uses this disguised runtime to execute a fileless Python implant decrypted in memory and launched hidden via wscript. The dropper scripts self-delete while the disguised runtime remains active on the compromised system, establishing command and control communications.

• Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC LauncherMalware2026-11-05
• Poisoned Source: APT29 Watering Holes Targets Mobile DevicesMalware2026-11-04
• Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party ScriptCampaign2026-10-30
• Inside Coruna and DarkSword Chains: From Web Lures to iOS ExploitationMalware2026-10-29
• Notorious Brazilian Magecart group hijacks Convertr checkouts via Plausible analyticsCampaign2026-10-27