Poisoned Pipeline

Poisoned Pipeline / Incidents / AS105

AS105 · 2025-10

Hyatt internal-dependency impersonation on npm

npm

SafeDep found three malicious npm packages disguised as Hyatt internal
dependencies, using install hooks. Same class as Schedaero (AS94) and
sl4x0 (AS104).

Mapped techniques

supply-chain internal name squat

T0120 · Initial Access · Dependency confusion

Hyatt-looking package names on public npm.

T0151 · Execution · Installation scripts

Install hooks executed the payload.

Sources