SocketPublished
Popular Tinycolor npm Package Compromised in Supply Chain Attack Affecting 40 Packages
By Socket Research Team
Excerpt
Secure your dependencies with us
Socket proactively blocks malicious open source packages in your code.
Install
Update (September 16, 2025): This campaign has expanded significantly. Our follow up documents nearly 500 affected npm packages, including several open source CrowdStrike packages. Read the latest analysis and guidance: https://socket.dev/blog/ongoing-supply-chain-attack-targets-crowdstrike-npm-packages A malicious update to @ctrl/tinycolor (2.2M weekly downloads) was detected on npm as part of a broader supply chai…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Socket on socket.dev.
Mentioned in the excerpt
More from Socket2
- Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access TrojanSocket · Published 28 Jul
- GlassWorm Loader Hits Open VSX via Developer Account CompromiseSocket · Published 31 Jan
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
