MalwarePublished 20 May 2026Updated 21 May 2026

Inside a Tor Backed Supply Chain Worm

Source AlienVault OTX General

Description

A sophisticated npm supply chain attack was uncovered involving the typosquatted package crypto-javascri, designed to mimic the legitimate crypto-js library. The malware harvests npm and GitHub credentials from infected systems, hijacks maintainer accounts, and automatically republishes trojanized versions of packages under trusted identities. The final payload incorporates a weaponized Arti Tor client with credential theft, cryptomining capabilities, privilege escalation via SUID exploitation, and systemd-based persistence mechanisms. The campaign specifically targets Linux developer systems and CI/CD environments, using Tor-based command-and-control infrastructure to maintain anonymity and resilience. The attack creates significant downstream supply chain risk through its worm-like propagation model.

Impact

The attack compromises developer systems by stealing credentials and hijacking trusted package maintainer accounts, allowing widespread distribution of trojanized packages. This undermines the integrity of the npm supply chain, potentially affecting numerous downstream users and projects. The inclusion of cryptomining and privilege escalation capabilities increases the operational impact on infected systems. The worm-like propagation model amplifies the risk by enabling rapid spread within Linux developer and CI/CD environments. The use of Tor for command-and-control complicates detection and mitigation efforts.

Defensive guidance

Mitigation should focus on detecting and removing the typosquatted package 'crypto-javascri' and monitoring for unauthorized package republishing activity. Restricting use of packages from unverified sources and enforcing multi-factor authentication on maintainer accounts can reduce risk. Network monitoring for Tor-based traffic and unusual systemd service activity may help identify infections. Since this is a supply chain attack, verifying package integrity and provenance before deployment is critical.

Summary

This threat is a malware campaign leveraging a typosquatted npm package 'crypto-javascri' to infiltrate developer environments. It steals credentials for npm and GitHub, enabling attackers to hijack maintainer accounts and push malicious package updates under trusted identities. The payload incorporates a modified Arti Tor client for covert command-and-control communications, facilitating credential theft, cryptomining, privilege escalation through SUID exploitation, and persistence via systemd services. The campaign specifically targets Linux systems used in development and CI/CD pipelines, employing worm-like propagation to spread across environments. The use of Tor infrastructure enhances attacker anonymity and resilience against takedown efforts.

Inside a Tor Backed Supply Chain Worm

Description

Impact

Defensive guidance

Summary

Indicators of compromise

Domains 1

Community reviews

Description

AI analysisMachine-generated, updated 21 May 2026, 16:44 UTC

MITRE ATT&CK techniques19 from threat tags

Technical details

Indicators of compromise

Domains 1

Community reviews

Related threats