Nascent Malware Campaign Targets npm, PyPI, and RubyGems Developers

⚠️September 5, 2023: This appears to be an ongoing campaign with additional packages published. The package timeline table has been updated to reflect this.

Phylum has been extremely busy in the past few weeks, reporting on multiple malware campaigns, including malicious updates to npm packages, malware masquerading as

campaign campaigns developers malicious malware malware campaign npm package packages phylum pypi reporting research rubygems september timeline updates