pkgjs-core

Incident Summary

@pkgjs/core npm phishing compromise

StepSecurity confirmed @pkgjs/core 0.2.8 as one of the npm packages affected by the July 2025 npnjs.com maintainer phishing campaign. The attacker used a phished maintainer credential path to publish malicious releases directly to npm without corresponding source repository changes. In the eslint-config-prettier cluster, the malicious package family executed install.js during installation and launched a bundled Windows DLL through rundll32 on Windows systems.

Date: 2025-07-18 to 2025-07-19
Category: Open Source
Target Surface: Package registry
Insertion Phase: distribution
Impact: Code Execution
Cause: Social Engineering

What Was Affected

Package pkgjs-core

LanguageJavaScript

ComponentLibrary

Artifact typesource archive

Domain typepackage host

Domain npmjs.com

Repository npmjs.com/package/@pkgjs/core

Compromised Versions

@pkgjs/core@0.2.8

Incident Context

Motive: Remote Code Execution
Attribution: Third Party
Transitive: Yes
User Impact: 0
Observed Duration: 1 days

@pkgjs/core npm phishing compromise

What Was Affected

Compromised Versions

Incident Context

Evidence

Compromised Artifacts

Current Artifacts and Analysis

External References

Source Data