Flooding Dropper floods npm with 850 malicious packages, exposing supply-chain blind spot
Sonatype researchers uncovered a coordinated campaign that has published nearly 850 malicious npm packages across hundreds of disposable accounts. By spreading tiny payloads and rotating account names, the attackers evade detection and overwhelm npm’s moderation, raising the stakes for JavaScript supply-chain security.