Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft observed a supply‑chain campaign where 33 malicious npm packages abused dependency‑confusion and typosquatting techniques to profile developer and build environments. The packages collected reconnaissance and environment metadata (and in related cases have been used to steal CI/CD and cloud secrets or drop further payloads), enabling follow‑on credential theft or lateral activity. Microsoft’s analysis describes the attack chain, actor tradecraft, and detection/mitigation opportunities to help defenders identify and disrupt similar npm supply‑chain abuse.