is

'is' npm Package Hijacked (Scavenger Malware)

Attackers running the npnjs.com npm phishing campaign hijacked an old maintainer account for the popular is package and used social engineering to regain package access: after the compromised old maintainer was removed, the attacker convinced current maintainers that npm had removed the account for missing 2FA, leading the account to be re-added. On July 19, 2025, the attackers published is 3.3.1 and 5.0.0. Reporting on the broader campaign describes the payload family as Scavenger, a cross-platform JavaScript loader that stole browser data, environment variables, and SSH keys and established an interactive remote shell via WebSocket.