Threats Tagged 'mal-2026-10234'

The slds-lsp-client npm package was published by a malicious actor as part of a dependency confusion attack. It impersonates an internal Salesforce SLDS language-server tooling package to trick misconfigured resolvers into installing it instead of the legitimate private package. The package includes a preinstall hook that executes automatically during installation, sending telemetry data such as the host's public IP and environment details to an attacker-controlled Sentry endpoint. This behavior is consistent with reconnaissance rather than direct exploitation. No patch or remediation guidance is provided in the data.