Threats Tagged 'mal-2026-10764'

The syft-acp-atoms package published on npm is a malicious package designed for dependency confusion attacks. It mimics an internal package name to trick misconfigured resolvers into installing it instead of the intended private package. Upon installation, it executes a preinstall hook that collects host telemetry including hostname, OS username, and public IP, then sends this data to an attacker-controlled Sentry endpoint. This behavior is consistent with reconnaissance activity to identify successful installs in targeted organizations. The package contains no legitimate library code and solely functions to beacon telemetry data to the attacker.