Poisoned Pipeline

Poisoned Pipeline / Incidents / AS131

AS131 · 2026-03

express-session-js typosquat paste-service RAT

npm

SafeDep: typosquat of express-session fetches and executes a full
RAT from a paste service (browser credentials).

Mapped techniques

supply-chain campaign

T0129 · Initial Access · Typosquatting

express-session lookalike.

T0172 · Execution · Runtime backdoor

Paste-service RAT.

T0184 · Credential Access · Harvesting sensitive information from files

Browser credentials.

Sources