Poisoned Pipeline

Poisoned Pipeline / Incidents / AS129

AS129 · 2026-04

big.js typosquats sjs/bjs/cjs-biginteger SSH backdoors

npm

SafeDep: three waves of big.js typosquats (sjs-biginteger,
bjs-biginteger, cjs-biginteger) from throwaway accounts implant SSH
backdoors and exfiltrate credentials.

Mapped techniques

supply-chain campaign

T0129 · Initial Access · Typosquatting

big.js lookalikes.

T0134 · Persistence · Add user

SSH backdoors.

T0184 · Credential Access · Harvesting sensitive information from files

Credential exfil.

Sources