Poisoned Pipeline / Incidents / AS181

AS181 · 2025-07

Protestware on npm targeting Russian-language users

npm

Socket: protestware on npm targeting Russian-language sites/users; later update 28 packages.

Mapped techniques

• T0121 Compromised legitimate artifact
• T0159 Malicious artifact execution

supply-chain campaign

Sources

• https://socket.dev/blog/protestware-on-npm-targets-russian-language-sites
• https://socket.dev/blog/protestware-update-28-npm-packages-affected-by-payload-targeting-russian-language-users