Nearly 800 Fake npm Packages Caught Spreading Malware Across Windows, Mac and Linux

Security researchers have uncovered a large-scale campaign involving nearly 800 malicious packages uploaded to npm, the popular repository developers use to download open-source code for building software. The packages are designed to run on Windows, Mac, and Linux systems, making them a broad threat regardless of what operating system a business uses.

According to researcher Paul from OpenSourceMalware, the packages rely on deceptive naming tricks—some appear to be AI-generated variations, while others mimic legitimate package names in the hope that a developer will make a typing mistake and install the wrong one. Once installed, these packages deliver a remote access trojan (RAT) and an information-stealing program, giving attackers the ability to control infected systems and extract sensitive data such as passwords and business files.

This campaign highlights a growing risk in the software supply chain: attackers are increasingly targeting the tools and code libraries that businesses and developers rely on, rather than attacking companies directly. Even small businesses that don't write their own software can be affected if they use products built with compromised open-source components.