Poisoned Pipeline / Incidents / AS138

AS138 · 2025-08

nyc-config typosquat of @istanbuljs/load-nyc-config

npm

SafeDep: nyc-config typosquat against @istanbuljs/load-nyc-config
(about 25M weekly downloads).

Mapped techniques

• T0129 Typosquatting
• T0109 Publish malicious artifact

supply-chain campaign

Sources

• https://safedep.io/nyc-config-malicious-package