Threats Tagged 'mal-2026-10765'

The syft-acp-core npm package is a malicious package published to the public npm registry as part of a dependency confusion reconnaissance campaign. It mimics an internal package name to trick misconfigured resolvers into installing it instead of the intended private package. The package includes a preinstall hook that runs automatically during npm install, which collects the installer's public IP and other default PII (hostname, OS username, runtime metadata) and sends this telemetry to an attacker-controlled Sentry project. This behavior is consistent with reconnaissance rather than direct exploitation. The malicious payload is identical to a previous campaign and uses hardcoded attacker-controlled Sentry endpoints.