The npm Threat Landscape: Attack Surface and Mitigations (Updated June 2)

Palo Alto Unit 42 published a collection of threat research and advisories covering active and emerging risks: npm supply‑chain evolution with wormable malware, CI/CD persistence and multi‑stage attacks; a macOS malvertising campaign (Operation FlutterBridge) distributing a new Flutter‑based backdoor (FlutterShell); Iranian APT Screening Serpens espionage using AppDomainManager hijacking and new RATs; misuse of the open‑source ROADtools framework for cloud intrusions; TamperedChef clusters delivered via trojanized productivity apps and malvertising; the evolution of Gremlin stealer with novel‑