Poisoned Pipeline

Poisoned Pipeline / Incidents / AS162

AS162 · 2026-03

dYdX packages after maintainer compromise

npmPyPI

Socket: malicious dYdX packages published to npm and PyPI after maintainer compromise.

Mapped techniques

supply-chain campaign

T0113 · Initial Access · Compromised user account

Maintainer compromise.

T0121 · Resource Development · Compromised legitimate artifact

dYdX packages on two registries.

Sources