Poisoned Pipeline / Incidents / AS122

AS122 · 2026-04

node-env-resolve full RAT

npmWindows software

SafeDep: node-env-resolve installs a full-featured RAT on developer
machines (screen stream, credential capture).

Mapped techniques

• T0109 Publish malicious artifact
• T0172 Runtime backdoor

supply-chain campaign

Sources

• https://safedep.io/malicious-npm-node-env-resolve-rat