Ongoing typosquatting campaign impersonates hundreds of popular npm packages

Researchers from Phylum, Socket and Checkmarx uncovered an ongoing npm typosquatting campaign that published hundreds of malicious packages impersonating popular JavaScript libraries (e.g., Puppeteer, Husky, testing utilities). The malware is multi-platform (Windows, Linux, macOS), performs host reconnaissance, establishes persistence, steals credentials, and uses Ethereum smart contracts as a novel C2 mechanism, making traditional blocking less effective; multiple SHA-256 hashes and package lists have been published.