Poisoned Pipeline

Poisoned Pipeline / Incidents / AS130

AS130 · 2026-04

mgc npm account takeover RAT

npm

SafeDep: package mgc was compromised via account takeover; four
malicious versions in rapid succession deployed a multi-platform RAT.

Mapped techniques

supply-chain campaign

T0113 · Initial Access · Compromised user account

Maintainer ATO.

T0121 · Resource Development · Compromised legitimate artifact

mgc malicious versions.

T0172 · Execution · Runtime backdoor

Multi-platform RAT.

Sources