Poisoned Pipeline / Incidents / AS73
got-fetch 5.1.11/5.1.12 Pycoon stealer
Checkmarx Zero found got-fetch 5.1.11 and 5.1.12 (~50k weekly downloads)
shipping crashreporter.dll, a Pycoon information stealer for Windows.
Maintainer @alexghr confirmed the same npnjs.com phishing mail as the
eslint-config-prettier wave (AS72), rotated tokens, and deprecated the
package. Payload differs from the prettier node-gyp.dll dropper. npm
removed the versions; cached copies in internal registries remained a
risk.
Mapped techniques
- T0113 Compromised user account
- T0121 Compromised legitimate artifact
- T0151 Installation scripts
- T0184 Harvesting sensitive information from files
supply-chain phished maintainer publish
Maintainer phished via npnjs.com lookalike.
got-fetch 5.1.11 and 5.1.12 on npm.
Dropped crashreporter.dll (Pycoon) on Windows.
Pycoon information stealer.