vant npm packages shipped XMRig

Catalogued from the tstromberg supplychain-attack-data dataset
(community-curated incident corpus). Included because first-party
sources exist for it; see the links below — vendor advisories, project
incident reports, and researcher write-ups. Not based on aggregator
coverage.

Mapped techniques

T0121 Compromised legitimate artifact
T0109 Publish malicious artifact

supply-chain campaign

T0121 · Resource Development · Compromised legitimate artifact

Published package versions carried the payload.

T0109 · Resource Development · Publish malicious artifact

Named in the tstromberg supplychain-attack-data corpus with first-party references.

Sources

https://www.sonatype.com/blog/npm-packages-rspack-vant-compromised-blocked-by-sonatype
https://securitylabs.datadoghq.com/articles/2025-q1-threat-roundup/#mut-1692-compromises-rspack-maintainers-account-to-distribute-cryptojacking-and-infostealer-malware