wshu.net 15-package multi-stage infostealer

SafeDep: one actor seeded 15 npm packages across 13 throwaway scopes
in a single morning. Each shipped a ~270KB obfuscated downloader
behind a postinstall hook (wshu.net campaign).

Mapped techniques

T0108 Accounts in public registry
T0109 Publish malicious artifact
T0151 Installation scripts

supply-chain burst publish

T0108 · Resource Development · Accounts in public registry

13 throwaway scopes in one morning.

T0109 · Resource Development · Publish malicious artifact

15 packages, same ~270KB downloader.

T0151 · Execution · Installation scripts

postinstall obfuscated downloader.

Sources

https://safedep.io/wshu-net-npm-credential-stealer-campaign