Threats Tagged 'mal-2026-10276'

The npm package 'abuden27' contains malicious code that abuses the npm registry by mass-publishing nearly 100 misleading package names. It includes a browser Service Worker that serves a heavily obfuscated web proxy frontend with a popunder redirect to a malicious site. The package does not auto-execute code during Node.js installation, so the primary harm is registry namespace abuse and browser-side malicious behavior when the assets are loaded. There is no evidence of installer-side compromise, but any system running this package should be considered fully compromised due to potential exposure of secrets and keys.