Rspack supply chain attack (Incident)

Researchers uncovered a supply-chain attack (attributed to MUT-1692) in which a compromised Rspack maintainer published trojanized @rspack/core and @rspack/cli (v1.1.7). The malicious packages executed an obfuscated Node.js postinstall payload that downloaded and decoded a secondary payload, installed a custom-configured XMRig miner (with a fallback to the official installer), and scanned local directories to exfiltrate cloud credentials—targeting developers using Huawei, Alibaba, and Tencent cloud services; the campaign was first flagged via a typosquatted npm package (argus3-test).