Schneier: Defense-Evading Malicious npm Packages Feel Like Nation-State Work

Security expert Bruce Schneier briefly pointed on his blog to a find he calls an impressive piece of malware: a set of malicious packages in the npm registry designed to evade defenses.

According to Schneier, the sheer sophistication of the work makes him think of a state-level actor. He is careful to add, however, that there is no direct evidence for this and certainly no attribution — it is only his personal impression of the quality of the work, not an established fact.

The note itself offers no further detail about the specific packages, the evasion mechanism, or who was affected. Still, the very fact that such a find in the npm ecosystem is worth a mention from Schneier is telling: software supply chains remain an attractive target, and the quality of attacks against them keeps rising.

Source: Schneier on Security