Poisoned npm Packages Disguised as Utilities Aim for System Wipeout

Researchers discovered two malicious npm packages (express-api-sync and system-health-sync-api) that embed backdoors—triggerable via HTTP endpoints and credentials—to delete application files and wipe systems. The packages, published from a single npm account, range from a simple destructive backdoor to a more sophisticated cross-platform, multi-endpoint wiper that performs reconnaissance and adapts commands by OS; both have been flagged for removal, and the case highlights an emerging destructive supply-chain threat.