Threats Tagged 'mal-2026-10066'

The nps-retrieval-diagnostics npm package version 9.9.9 contains malicious code that installs persistent backdoor access on the host. When executed, it adds a cron job running every 10 minutes that contacts a remote server and modifies the user's shell configuration to maintain persistence. It also attempts to harvest environment variables that resemble credentials. The package masquerades as an internal diagnostic tool and uses social engineering to trick operators into running it. This is consistent with a dependency confusion attack targeting internal package names.