The packages looked boring. A clipboard utility. A small canvas helper. A timezone formatter. Nothing you'd look twice at. They had plausible READMEs, polite maintainers, and modest but real download counts.
They were all published by the same campaign — linked, by multiple threat intelligence teams, to a state-backed group that has historically funded itself through cybercrime.
The trick was patience. The packages did exactly what they claimed for months. Clean code. Real functionality. Genuine bug fixes in the issues tab. They built reputation the slow way, the way a real maintainer would, until a few of them had been adopted as transitive dependencies by other projects.
Then, on a Tuesday, the maintainer pushed a patch version to three of them. The patch added a postinstall script that checked the host environment for cryptocurrency wallet software and credential files, exfiltrated anything it found, and then removed itself from the package so the next install looked clean again.
A financial firm lost a six-figure sum from a hot wallet on a developer laptop. A second victim, an exchange engineer, lost more.
The packages stayed functional the entire time. That's what makes this one hard to sleep on. The malicious code was a guest in a house that genuinely worked. A scanner that only looks at behavior at install time would have seen a helpful utility. The threat wasn't in the code — it was in the calendar. It was always going to arrive on a Tuesday, eventually.