Threats Tagged 'dependency confusion'

Microsoft Threat Intelligence has identified an active supply chain attack involving malicious npm packages that exploit dependency confusion. These packages, published under aliases mimicking legitimate organizational namespaces, execute obfuscated reconnaissance payloads via npm lifecycle hooks to collect system information, environment variables, and developer credentials. The campaign targets Windows, macOS, and Linux platforms and includes CI/CD detection bypass features. While currently operating in reconnaissance-only mode, the architecture supports server-side toggling for potential full exploitation. The malicious packages connect to a common command-and-control server and deploy a JavaScript dropper for environment fingerprinting. Forensic evidence links all malicious accounts to a single operator. No known exploits in the wild have been reported, and no official patch or remediation guidance is currently available.