Poisoned Pipeline

Poisoned Pipeline / Incidents / AS160

AS160 · 2026-04

175 npm packages hosting phishing infrastructure

npmCDN / web assetsGit / GitHub

Socket: 175 malicious npm packages used the registry to host phishing infrastructure.

Mapped techniques

supply-chain campaign

T0109 · Resource Development · Publish malicious artifact

175 packages as hosting.

T0110 · Resource Development · Advertise malicious artifact

Phishing infra on npm.

Sources