Poisoned Pipeline / Incidents / AS69
npm is 3.3.1 / 5.0.0 via phished old maintainer
On 19 July 2025 malicious versions 3.3.1 and 5.0.0 of the widely used
type-checking package is were published. Attackers phished an old
maintainer, had that account dropped from the package, then emailed
current maintainer Jordan Harband claiming npm had removed them for
missing 2FA. Re-adding the account let the attackers publish the next
morning. Same phishing campaign as eslint-config-prettier. Malicious
code sat unnoticed for about six hours. StepSecurity write-up; Harband
posted the sequence on Bluesky.
Mapped techniques
- T0113 Compromised user account
- T0137 Weak authentication methods
- T0121 Compromised legitimate artifact
- T0109 Publish malicious artifact
supply-chain social-engineered maintainer restore
Old maintainer npm account phished.
Ownership restore via a 2FA-removal story, no extra verification.
is 3.3.1 and 5.0.0 on npm.
Published from a restored maintainer session.