Poisoned Pipeline / Incidents / AS56
Elf-Stats Christmas npm spam worm
On 3 December 2025 OpenSourceMalware named Elf-Stats: a Christmas-themed
npm spam campaign of packages whose names start with elf-stats. 36
packages across 23 npm users at publication, with package.json claiming
automatic generation every two minutes. Payload exfiltrated filenames
under /opt to a webhook.site URL. Low likelihood of accidental install
given the names; still a worm that inflates the malicious-package corpus.
Mapped techniques
supply-chain npm
23 npm users publishing elf-stats-* packages.
Auto-generated packages every two minutes.