DailyDarkWeb reports that software security teams are facing a sophisticated new supply chain threat within the open-source ecosystem.
Following a year of high-profile incidents, including the Shai-hulud npm worm and the North Korea-linked Graphalgo campaign targeting cryptocurrency developers, researchers at ReversingLabs have uncovered a novel operation.
Dubbed the “Ghost campaign,” this new wave of attacks relies on fake npm installation alerts to trick developers into handing over their sudo passwords, ultimately deploying a Remote Access Trojan (RAT) on victim machines.
The Ghost Campaign and Fake Installation Logs
The Ghost campaign, first detected in early February 2026, initially consisted of seven malicious packages published by a single npm user named mikilanjillo.
These packages were designed to hide their true purpose by phishing for elevated system privileges in a highly deceptive manner.
A prime example is the package react-state-optimizer-core, which masquerades as a lightweight utility for asynchronous state management in React applications.
While the final payload is a standard download-and-execute malware, the method used to deploy it is remarkably sophisticated.
Payload Delivery and Indicators Of Compromise
Once the sudo password is secured, the malware connects to a remote server to download its final payload. For most discovered packages, the download URL and decryption key are hosted on a Telegram channel.
After downloading the encrypted payload, the malware uses a hardcoded string combined with the fetched key to decrypt it.
The resulting RAT is then executed using the previously stolen sudo credentials. Certain package versions also include an additional decryptor file designed to assist the RAT with its data-stealing functions.
The final malware is a highly capable RAT built to steal cryptocurrency wallets and sensitive data, while also maintaining persistent communication with a command-and-control server to receive further instructions.
| Package Name | Version | SHA1 Hash |
|---|---|---|
| react-performance-suite | 2.0.0 | bdffc2f98ff422db9f9ddc190401cfcb686e3c32 |
| react-performance-suite | 2.0.1 | 5928e3121f12f3c5d690bc7968b28b2f67835ef5 |
| react-state-optimizer-core | 1.0.0 | cbe7c87293de7ab5853e2aef3f638d54c45f5c9f |
| react-state-optimizer-core | 1.0.2 | 1b4916fd65934f2f9efa7125335a85c104e1e17c |
According to ReversingLabs research, security experts suggest this campaign might be an early test run for a larger operation. In March, JFrog researchers documented a similar malicious package, openclawai, that shares technical overlaps with the Ghost campaign.
The presence of console debug messages in some of the early packages further supports the theory that threat actors were actively testing and refining their phishing techniques before launching a broader attack.
Organizations are urged to remain vigilant and monitor their development environments for suspicious activity.
The following Indicators of Compromise (IoCs) have been identified in connection with the Ghost campaign to help security teams detect and block these malicious packages.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
