Poisoned Pipeline / Incidents / AS180

AS180 · 2025-08

Black Basta dependency-confusion ambitions in OSS

npm

Socket: Black Basta ransomware group’s dependency-confusion activity in open-source ecosystems.

Mapped techniques

• T0120 Dependency confusion
• T0109 Publish malicious artifact

supply-chain campaign

Sources

• https://socket.dev/blog/black-basta-dependency-confusion-ambitions-and-ransomware-in-open-source-ecosystems