Malicious package with AdaptixC2 framework agent found in npm registry

A malicious npm package named 'https-proxy-utils' was discovered containing a post-install script that downloads and executes the AdaptixC2 post-exploitation framework agent. The package impersonated legitimate utilities and cloned functionality to evade detection. It targets Windows, Linux, and macOS platforms with tailored payload delivery methods. Once installed, the AdaptixC2 agent enables remote access, command execution, and persistence, posing significant risks to affected systems. This incident exemplifies the increasing abuse of open-source software supply chains as attack vectors. No known exploits in the wild have been reported yet, but the threat remains active and multi-platform. The malicious infrastructure is hosted on the domain cloudcenter.top, which serves payloads for different OS architectures. European organizations relying on npm packages for development or deployment are at risk, especially those with mixed OS environments. Mitigation requires vigilant package vetting, monitoring for suspicious post-install scripts, and network controls to block malicious domains.

• Stray Cat, Open Doors: How k0t Wanders Through the Network EdgeCampaign2026-10-21
• Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksHighVulnerability2026-10-23
• LiteLLM Compromised in Fresh Supply Chain AttackBreach2026-10-23
• AI-driven, large-scale nation-state campaign using ARTEX enables supply chain compromiseCampaign2026-10-21
• Oracle October 2026 Critical Patch Update Addresses 1209 CVEsCriticalVulnerability2026-10-20