Poisoned Pipeline / Incidents / AS77
Moika npm dependency-confusion (Sberbank / EMCD impersonation)
OpenSourceMalware’s Jan–May 2026 campaign review names Moika after the
shared C2 oob.moika.tech. Beginning 27 May 2026 four npm accounts
published 183 packages across nine scoped namespaces impersonating
internal tooling at a Russian cloud provider, Sberbank, and the EMCD
crypto exchange. Packages used dependency-confusion version inflation,
READMEs with fabricated internal registry URLs and Jira links, and
postinstall hooks that dumped environment variables. A hardcoded
X-Secret header tied the four accounts together. Intent is ambiguous:
account mr.4nd3r50n has a 2024 bug-bounty history on the same names,
payloads ran in RECON_ONLY, and two packages were marked “BugBounty
testing” next to working stealers.
Mapped techniques
- T0120 Dependency confusion
- T0136 Brandjacking
- T0109 Publish malicious artifact
- T0151 Installation scripts
supply-chain scoped namespace confusion
Inflated versions and internal-looking scoped names on public npm.
Sberbank, EMCD, and internal-tool namespaces.
183 packages from four accounts, one X-Secret header.
postinstall dumped environment variables to oob.moika.tech.