forge-jsx / forge-jsxy Autodesk-themed npm RAT

SafeDep: forge-jsx posed as an Autodesk Forge SDK and on install
deployed a keylogger, recursive .env scanner, and shell-history theft.
After takedown, forge-jsxy continued with 22 versions over 22 days
(crypto stealers and more). Same operator, iterated RAT.

Mapped techniques

T0136 Brandjacking
T0109 Publish malicious artifact
T0151 Installation scripts
T0172 Runtime backdoor

supply-chain sdk impersonation rat

T0136 · Initial Access · Brandjacking

Autodesk Forge SDK impersonation.

T0109 · Resource Development · Publish malicious artifact

forge-jsx then 22 forge-jsxy versions.

T0151 · Execution · Installation scripts

Install-time keylogger and .env scanner.

T0172 · Execution · Runtime backdoor

Multi-platform RAT, iterated 22 days.

Sources

https://safedep.io/malicious-forge-jsx-npm-rat
https://safedep.io/malicious-forge-jsxy-npm-rat-evolution