Poisoned Pipeline / Incidents / AS127

AS127 · 2026-04

dom-utils-lite / centralogger SSH backdoor via Supabase

npm

SafeDep: dom-utils-lite and centralogger inject attacker SSH keys
into ~/.ssh/authorized_keys and exfiltrate server metadata to
Supabase-hosted C2.

Mapped techniques

• T0109 Publish malicious artifact
• T0134 Add user
• T0156 Exfiltration over webhooks

supply-chain campaign

Sources

• https://safedep.io/malicious-dom-utils-lite-npm-ssh-backdoor