TeamPCP supply chain attack compromises 300+ npm packages

A coordinated software supply chain attack struck the npm package registry on May 19, compromising more than 300 packages through a single stolen maintainer account. Security researchers reported that the campaign, linked to a threat actor known as TeamPCP, published 639 malicious versions of 323 unique packages within roughly one hour.

The attackers gained access to the npm account "atool," which held publishing rights to over 500 packages including the entire AntV data visualization ecosystem from Alibaba. Among the affected packages are echartsforreact with about 1.1 million weekly downloads, sizesensor with 4.2 million, and timeago.js with 1.15 million. The collective weekly download count across all affected packages in this wave is estimated at around 16 million.

Each compromised package added a preinstall hook that executed an obfuscated payload. The malware harvested credentials from cloud services including AWS, Google Cloud, and Azure, as well as GitHub tokens, SSH keys, Kubernetes service account tokens, and passwords from local vaults. Stolen data was exfiltrated through two channels: encrypted transmission to a command and control server, and publication to public...