Poisoned Pipeline / Incidents / AS179

AS179 · 2025-09

Destructive npm packages with remote wipe

npm

Socket: destructive npm packages enable remote system wipe (kill-switch / wipeout).

Mapped techniques

• T0109 Publish malicious artifact
• T0149 Delete repositories

supply-chain campaign

Sources

• https://socket.dev/blog/destructive-npm-packages-enable-remote-system-wipe
• https://socket.dev/blog/npm-package-wipes-codebases-with-remote-trigger
• https://socket.dev/blog/wget-to-wipeout-malicious-go-modules-fetch-destructive-payload