Poisoned Pipeline / Incidents / AS132

AS132 · 2026-03

react-refresh-update Meta library impersonation

npmGit / GitHubWindows software

SafeDep: malicious package impersonating react-refresh (Meta,
about 42M weekly downloads) injects a cross-platform trojan on
developer machines.

Mapped techniques

• T0136 Brandjacking
• T0109 Publish malicious artifact
• T0159 Malicious artifact execution

supply-chain campaign

Sources

• https://safedep.io/malicious-npm-react-refresh-update