Severity: HighIncidentSupply chain
Malicious npm Packages Impersonate Web3 Program to Deliver Backdoors and Steal Credentials from AI Developer Tooling
Global
Live intelligence. Items are aggregated from public sources and summarised automatically. Always verify against the linked source before acting.
A fraudulent Web3 accelerator campaign distributed information-stealing malware and backdoors via compromised npm packages, targeting developers with offers of free API credits for Claude and Gemini. The packages affected Windows and macOS systems and aimed to hijack AI agent traffic and exfiltrate credentials associated with AI services.
What to do
Audit npm dependency manifests for suspicious packages offering AI service credits, and revoke any exposed API keys for Claude, Gemini, and coding platforms.
Mapped framework pillars
Sources
#npm#malware#supply chain#AI credentials#backdoor#information stealer