Poisoned Pipeline / Incidents / AS137

AS137 · 2025-09

SLF4J Java logger impersonation on npm

npm

SafeDep: malicious npm package impersonating Java logging framework
SLF4J (cross-ecosystem name squat).

Mapped techniques

• T0129 Typosquatting
• T0109 Publish malicious artifact

supply-chain campaign

Sources

• https://safedep.io/malicious-npm-package-impersonating-slf4j
• https://www.wiz.io/blog/sitf-sdlc-threat-framework