Four coordinated npm supply chain campaigns active in May–June 2026 — TTPs, IOCs, and detection notes
Source Reddit NetSec
Discussion
Four coordinated npm supply chain campaigns were active during May and June 2026, targeting the npm ecosystem with various sophisticated techniques including dependency confusion, namespace compromise, scope confusion, and typosquatting. These campaigns employ multi-stage postinstall execution chains that fetch and run platform-specific payloads, aiming to steal environment variables, CI/CD secrets, cloud metadata service tokens, and other sensitive credentials. The campaigns affect multiple platforms (Windows, macOS, Linux) and cloud environments (GCP, Azure). Detection relies on identifying version sentinels, cloud metadata endpoint access patterns, and characteristic postinstall behaviors. An open-source scanner with detection capabilities for these campaigns is available for community use.
r/netsec (opens in a new tab)u/SaveAmerica20240 points0 comments
Documenting four campaigns that hit npm over the last two weeks. Posting for community awareness — IOCs and behavioral patterns below.
Sonatype-2026-003429 — 176-package dependency confusion (May 28, 2026)
Tracked by Sonatype (full writeup). Sentinel versions: 99.99.99, 9.9.9, 9.9.10, 10.10.10, 11.11.11, 99.5.8. Execution chain: postinstall fingerprints host → fetches platform-specific JS payload → downloads and executes binary → spawns detached background process. Russian-language comments embedded in source. Cross-platform (Windows/macOS/Linux). Targets env vars, CI/CD secrets, auth tokens.
Miasma — @redhat-cloud-services namespace compromise (June 1, 2026)
Compromised Red Hat employee GitHub account used to push orphan commits to RedHatInsights repositories, bypassing code review. 32 package versions affected, ~80K weekly downloads. Payload self-identifies as “Miasma: The Spreading Blight” — a variant of the Mini Shai-Hulud framework. Notably targets GCP (metadata.google.internal/computeMetadata/v1) and Azure (169.254.169.254/metadata/instance) cloud identities rather than static .env files.
Yandex-aliased scope confusion — 33 packages, 9 org scopes (May 28–29, 2026)
Threat actor registered internal corporate namespace scopes (@cloudplatform-single-spa, @sber-ecom-core, @data-science) and published with inflated versions to beat CI/CD resolution. Currently operating in hardcoded RECON_ONLY mode — profiling SSH keys, env vars, hostnames, internal network paths. Designed to pivot to full exfiltration once high-value targets are fingerprinted.
OpenSearch/Elasticsearch typosquatting — 14 packages (May 28, 2026)
Actor cloned upstream OpenSearch repo URLs in package.json to pass casual inspection. Gen-2 variant uses a legitimate Bun runtime GitHub Release as a binary loader to bypass Node-specific behavior analytics. Targets IMDSv2, ECS task roles, and HashiCorp Vault secrets.
Detection notes: Version sentinel matching, GCP/Azure IMDS endpoint patterns, and two-stage postinstall behavior (remote fetch → binary exec → detached spawn) are the most reliable static signals across all four campaigns. We added detectors for these patterns to our open-source scanner if useful: https://github.com/lateos-ai/npm-scan