Inside a Tor Backed Supply Chain Worm

CloudSEK TRIAD identified a sophisticated npm typosquatting supply-chain campaign distributing the package "crypto-javascri" that embeds a Rust ELF to harvest npm and GitHub credentials, silently republish trojanized packages under compromised maintainer accounts, and deploy a weaponized Arti (Tor) client providing credential theft, cryptomining, privilege escalation, systemd persistence, and Tor-based C2; defenders should monitor for unexpected npm preinstall hooks, audit and revoke tokens, and alert on Tor/Arti activity and unusual user-level persistence.