A targeted software supply chain campaign has compromised developer workstations and automated build pipelines by distributing malicious open-source packages. The implants execute automatically upon package import without requiring post-installation build scripts.
The activity involves 14 trojanized packages published to the npm registry, including streak-metrics-math and streak-kit-map. Security telemetry confirms that importing any affected package triggers the immediate execution of a bundled binary payload. The binary drops RedC2 4.0, a cross-platform command and control beacon for Linux environments that features artificial intelligence assisted command execution, local credential harvesting, and payload loading routines. Because execution occurs during standard code execution rather than installation hooks, traditional build-time static scanners failed to generate alerts.
Subverting developer environments and continuous integration pipelines introduces extreme enterprise supply chain exposure. Armed with a persistent beacon inside developer environments, adversaries can capture source code repositories, siphon cloud deployment tokens, and inject secondary backdoors into commercial software releases.
– Audit package-lock.json files across all development repositories immediately to detect and remove affected streak package variants.
– Enforce strict private package registries and dependency scoping policies across developer and continuous integration pipelines.
– Rotate all cloud access tokens, SSH deployment keys, and API credentials present on developer machines that executed the packages.
– Monitor endpoint process telemetry for unexpected detached processes executing out of Node.js application paths.
Software supply chain defense requires continuous package integrity verification and runtime behavior monitoring to ensure third-party code libraries cannot serve as covert entry points for corporate networks. #CodeDefence #npm #SupplyChain #RedC2 #DevSecOps #AppSec #Malware #LinuxSecurity
/
