AISEC > Security News > 19 Malicious npm Packages Steal Crypto Keys & CI Secrets
February 23, 2026 #attack Source: The Hacker News 2 min read · 571 words

Malicious npm Packages Harvest Crypto Keys, CI Secrets, and API Tokens

Шкідливі npm-пакети викрадають криптоключі, секрети CI та API-токени

Timeline: When the Alarm Bells Started Ringing

The malicious attack in cyber security emerged sometime before February 2026, though the exact genesis remains murky. What we know: cybersecurity researchers at Socket uncovered an active supply chain attack campaign using at least 19 malicious npm packages designed to target developers at scale. The discovery came recently enough that the threat is still unfolding in real time.

Six months of potential exposure.

That's the window we're looking at for how long these packages may have been harvesting credentials from unsuspecting developers who simply wanted to use what they thought were legitimate dependencies.

The Discovery

Socket, the supply chain security firm, identified the campaign and christened it SANDWORM_MODE—a name that signals their assessment of its sophistication and intent. The researchers didn't stumble upon this by accident. They were doing what responsible security firms do: analyzing package behavior patterns, hunting for anomalies, watching for the telltale signs of malicious code attack cyber awareness failures.

And they found something ugly.

At least 19 separate npm packages. Each one designed to extract sensitive data. The attackers weren't trying to be subtle. They weren't hiding rootkits or planting backdoors for future exploitation. They wanted your secrets. Now.

Technical Analysis

Here's what's actually happening beneath the surface. These packages, when installed as dependencies in a project, execute code during the installation process. Installation hooks—a feature npm provides for legitimate use cases—become the vector for malicious file execution vulnerability. The attacker's code runs before you've even used the package once.

The malicious code vulnerability is deceptively straightforward. The packages target high-value targets: cryptocurrency wallet keys, API tokens, CI/CD secrets stored in environment variables, SSH keys, authentication credentials. Everything a developer might have configured in their local environment or CI pipeline.

Think about your own setup. How many sensitive credentials are sitting in your .env file right now? In your CI system? That's the goldmine these attackers are after.

What makes this particularly nasty is the malicious cyber attacks meaning here—it's not about destroying systems or causing chaos. It's about theft. Quiet, efficient, wholesale credential harvesting.

Damage Assessment

The real question is: how many developers actually installed these packages?

We don't have a complete damage assessment yet, according to The Hacker News reporting on the incident. That's the terrifying part. The malicious cyber attacks consequences could be massive, or they could be contained. We simply don't know how many projects pulled in these compromised dependencies.

But here's what we do know: every installation represents potential exposure. Every cryptocurrency wallet, every API token, every CI secret harvested becomes a weapon in the attacker's hands.

The malicious cyber security implications spiral outward. An attacker with harvested CI credentials can access repositories. With API tokens, they can escalate privileges across integrated services. With crypto keys, they have direct access to digital assets.

Mitigation

First, the obvious: audit your dependencies. Check your package-lock.json against the list of compromised packages. If you've installed any of the 19 packages identified in SANDWORM_MODE, treat it as a breach.

Rotate your credentials. All of them. Crypto keys, API tokens, CI secrets, SSH keys. Don't wait. Don't rationalize that you're probably fine.

Enable malicious code vulnerability warnings on your development tooling. Socket and similar platforms can scan your dependencies continuously. GitHub's Dependabot exists for exactly this reason. Use it.

And frankly, this should have been caught sooner—or prevented entirely. The npm ecosystem needs better verification mechanisms for package publishers. Right now, the supply chain is only as secure as the least vigilant developer in the chain.

Check your logs. Assume compromise. Act accordingly.

Read original article →

Concerned about your project's security? Run an automated pentest with AISEC — AI-powered scanner with expert verification. Go to dashboard →