One npm account, 14 packages, four scopes: a dependency-confusion campaign built to look like someone's internal SDK
This story is from 2026-10-26. It is preserved in the archive; the latest stories are on the live feed.
Between 21:23 UTC on 23 October 2026 and 14:28 UTC on 25 October 2026, an npm account called wiseke published 14 packages across four scopes: @greenlake , @sxm-web , @drone-js-ext and @ppa-web-components . On 26 October, GitHub's Advisory Database reviewed all of them as malware, including @greenla…
Read the full story at DEV Community — AI ↗
Timeline · 1 report
- 2026-10-26 08:40 · DEV Community — AI
One npm account, 14 packages, four scopes: a dependency-confusion campaign built to look like someone's internal SDK