Malicious npm packages abuse dependency confusion to profile developer environments

Microsoft discovered a dependency‑confusion campaign that published 33 malicious npm packages which execute during install to collect reconnaissance data from developer and build environments. The packages abuse package naming and registry resolution to cause developer machines and CI systems to fetch attacker-controlled code, enabling environment profiling (installed tools, credentials, CI metadata) that can facilitate subsequent credential theft or lateral movement. The report outlines the attack chain, observed tradecraft, detection opportunities, and mitigations (registry scoping/locking,