Poisoned Pipeline / Incidents / AS125
npm-global-util preinstall credential theft
SafeDep: npm-global-util by raya4321 exfiltrates credentials and
system recon via a preinstall hook.
Mapped techniques
- T0109 Publish malicious artifact
- T0151 Installation scripts
- T0140 Harvest tokens from environment variables
supply-chain campaign
raya4321 package.
preinstall hook.
Credential exfil.