Elf-Stats NPM Christmas Spam Campaign

A rapid NPM spam campaign named “Elf-Stats” has published dozens of Christmas-themed packages (36–40 packages across ~23 user accounts) that contain malicious payloads; early samples used index.js to POST data to an attacker endpoint, while later samples abuse package.json postinstall scripts to exfiltrate local /opt files to webhook URLs. The report lists affected package names, user accounts, and example payloads, showing active abuse of the NPM ecosystem to perform data exfiltration when packages are installed.