sl4x0 dependency confusion (92 packages, Fortune 500)

SafeDep: sl4x0 actor published 92 dependency-confusion packages aimed
at 20+ organizations including Adobe, Ford, Sony, and Coca-Cola.
Internal-looking names on public npm.

Mapped techniques

T0120 Dependency confusion
T0109 Publish malicious artifact

supply-chain multi-org name squat

T0120 · Initial Access · Dependency confusion

92 packages, 20+ orgs (Adobe, Ford, Sony, Coca-Cola).

T0109 · Resource Development · Publish malicious artifact

Sustained campaign under sl4x0.

Sources

https://safedep.io/sl4x0-dependency-confusion-campaign