IT Consultancy
IT Consultancy Get expert guidance to leverage technology for your business growth. We help you identify the right IT solutions, optimize infrastructure, and ensure your digital environment is secure,…
Malicious npm Packages Disguised as Plugins Target Developers
Digital Marketing
Digital Marketing Grow your brand and reach the right audience with data-driven marketing strategies. We help you create campaigns that convert, manage social channels effectively, and optimize your d…
Privacy Policy
Privacy Policy At CometSoul, accessible from https://cometsoul.com, one of our main priorities is the privacy of our visitors. This Privacy Policy document contains types of information that is collec…
Terms and Conditions
Welcome to CometSoul! These terms and conditions outline the rules and regulations for the use of CometSoul’s Website, located at https://cometsoul.com. By accessing this website we assume you a…
Disclaimer
If you require any more information or have any questions about our site’s disclaimer, please feel free to contact us. Disclaimers for CometSoul All the information on this website – https…
Managed Wi-Fi Service
Managed Wi-Fi Service Build a fast, stable, and secure Wi-Fi for your business at Zero depreciation cost. Enterprise-Grade Guest Wi-Fi With $0 Upfront Hardware Costs. We provide, install, and support …
Smart Business System Integrator
Smart Business System Integrator Simplify your daily operations with smart systems that automate bookings, schedules, and routine tasks so you can focus on growing your business. We set up and integra…
Security researchers have uncovered a campaign involving 36 malicious npm packages disguised as legitimate plugins, targeting developers and backend systems. These packages impersonated popular Strapi CMS plugins, making them appear safe and trustworthy to unsuspecting users.
Once installed, the packages deployed hidden payloads capable of exploiting services like Redis and PostgreSQL, opening reverse shells, stealing credentials, and installing persistent backdoors. This allowed attackers to gain long-term access to compromised environments.
What makes this campaign stand out is its sophistication. Instead of using a single method, attackers distributed multiple variants with different techniques, showing continuous development and adaptation.
This case highlights the growing risk of software supply chain attacks. Developers should always verify packages, review dependencies carefully, and avoid installing untrusted or unfamiliar plugins.
source: https://thehackernews.com/2026/04/36-malicious-npm-packages-exploited.html