Vpmdhaj npm preinstall credential-harvest campaign
Campaign
Summary
Hide ▲
Show ▼
A new vpmdhaj supply-chain campaign has surfaced in 14 malicious npm packages that use a preinstall credential harvester to steal AWS credentials, HashiCorp Vault tokens, npm tokens, and CI/CD secrets from developer hosts. The packages were published on May 28, 2026 and were built to look like legitimate developer tooling. That turns ordinary installs into a high-risk entry point for downstream compromise and secret theft.
Related Happenings
AsyncAPI repositories and npm publishing workflow hit by network compromise
Incident
H score27
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
AsyncAPI repositories and npm publishing workflow hit by network compromise
IncidentAbout this happening: The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware Activity
H score9
First: 11.07.2026 20:59
Last: 11.07.2026 20:59
Sources 1
About this happening:
The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
Jscrambler 8.14.0 malicious preinstall infostealer release
Malware ActivityAbout this happening: The jscrambler 8.14.0 npm release now ships a malicious preinstall hook that runs a Rust infostealer during install, putting developer and CI secrets at risk on ...
@Injectivelabs/[email protected] wallet-stealing package
Malware Activity
H score30
First: 10.07.2026 20:29
Last: 10.07.2026 20:29
Sources 1
About this happening:
The malicious @injectivelabs/[email protected] package is a wallet-stealing malware activity that can expose private keys and mnemonic seed phrases when library functions...
@Injectivelabs/[email protected] wallet-stealing package
Malware ActivityAbout this happening: The malicious @injectivelabs/[email protected] package is a wallet-stealing malware activity that can expose private keys and mnemonic seed phrases when library functions...
Injective Labs SDK project GitHub repository hit by network compromise
Incident
H score21
First: 09.07.2026 23:10
Last: 09.07.2026 23:10
Sources 1
About this happening:
The Injective Labs SDK project suffered a GitHub repository compromise that let attackers publish a malicious @injectivelabs/sdk-ts v1.20.21 package, putting developer...
Injective Labs SDK project GitHub repository hit by network compromise
IncidentAbout this happening: The Injective Labs SDK project suffered a GitHub repository compromise that let attackers publish a malicious @injectivelabs/sdk-ts v1.20.21 package, putting developer...
Malicious npm and PyPI payment SDK typosquat packages
Malware Activity
H score40
First: 09.07.2026 18:09
Last: 09.07.2026 18:09
Sources 1
About this happening:
The 17 malicious npm and PyPI packages targeted Paysafe, Skrill, and Neteller SDKs to steal system information and developer secrets, then send the data to an Ng...
Malicious npm and PyPI payment SDK typosquat packages
Malware ActivityAbout this happening: The 17 malicious npm and PyPI packages targeted Paysafe, Skrill, and Neteller SDKs to steal system information and developer secrets, then send the data to an Ng...
Timeline
-
29.05.2026 12:11 2 articles · 1mo ago
vpmdhaj publishes 14 malicious npm packages that harvest developer secrets
Initial DisclosureA threat actor using the handle vpmdhaj published 14 malicious npm packages on May 28, 2026, using typosquatted names that resemble OpenSearch, ElasticSearch, DevOps, and environment-configuration tooling. The packages launch a purpose-built credential harvester through a preinstall hook to steal AWS credentials, HashiCorp Vault tokens, npm tokens, and CI/CD pipeline secrets from developer hosts.
Show sources
- Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets — thehackernews.com — 29.05.2026 12:11
- Malicious Sicoob NuGet Steals Banking Credentials as npm Packages Target Cloud Secrets — thehackernews.com — 29.05.2026 12:11