Fake npm install messages are the latest social engineering trick in the open source supply chain, with attackers abusing npm post‑install scripts to silently deploy a crypto‑stealing remote access trojan (RAT) in what ReversingLabs is calling the “Ghost campaign.”
By wrapping their payloads in realistic but entirely bogus npm install logs, the threat actors turn routine package installation into a covert phishing and malware delivery channel that is hard for developers to notice in the moment.
Over the last year, defenders have already had to process incidents like the Shai‑hulud npm worm and Graphalgo.
This North Korea‑linked campaign used fake recruiter approaches and “coding tests” to drop custom RATs onto crypto developers’ systems.
Ghost fits into the same trend of increasingly interactive supply chain attacks, but shifts the focus to tricking developers at install time rather than just slipping malicious code into dependencies.
ReversingLabs first saw Ghost activity at the start of February 2026, tied to seven npm packages published by a user using the handle “mikilanjillo,” each reusing a common downloader core and layering on new obfuscation and phishing features.
One representative example is react‑state‑optimizer‑core, which advertises itself as a “lightweight utility layer for asynchronous state management in React applications” while actually serving as a thin wrapper around a download‑and‑execute routine.
The innovation in Ghost is not a particularly advanced payload, but a polished console experience that looks like a noisy npm install session.
After installation, the malicious script prints detailed status messages claiming to fetch additional packages, with package names randomly chosen from a predefined list, injects random delays between lines, and sometimes even shows a progress bar that “fills” based on random values.
Because this output appears after a legitimate install and mimics expected npm behavior, most developers are likely to accept it as normal chatter and move on.
Hidden in this stream, however, the script eventually reports an “optimization” issue or partial install failure and prompts the user for their sudo password to fix supposedly missing components.
The sudo prompt is the real objective: once the user enters and the script verifies the password, the downloader silently executes while fake logs continue to scroll, giving the impression that some intensive optimization is still running.
The downloader then retrieves the URL of the final payload and part of its decryption key from an attacker‑controlled Telegram channel, with one variant (coinbase‑desktop‑sdk@1.5.19) instead hiding this information in a web3‑themed post on teletype. in.
The final stage is decrypted using a password derived from a hardcoded string plus the key fetched from Telegram or the web3 post, written to disk, and executed with the previously phished sudo credentials.
Some package variants, such as carbon‑mac‑copy‑cloner and certain coinbase‑desktop‑sdk versions, add a separate decryptor component to extend the RAT’s stealing capabilities.
The resulting malware focuses on harvesting crypto wallets and other sensitive data, while maintaining remote access for command execution from a C2 server.
There are strong indicators that Ghost may be an early wave or parallel branch of the GhostClaw campaign documented by JFrog in March 2026, which used a malicious npm package, @openclaw‑ai/openclawai, to deliver a multi‑stage RAT with extensive credential and wallet theft functionality.
While the infrastructure differs, both operations heavily abuse npm install‑time scripts and staged payloads, and they appear to share a similar final RAT family.
ReversingLabs notes that some Ghost packages contain obvious debug messages that would likely tip off victims, suggesting these releases could be development builds or an early “test run” of the broader campaign.
For now, defenders are advised to treat any npm package that asks for sudo during installation, displays unusual “optimization” prompts, or downloads external content post‑install as inherently suspicious, and to lean on automated supply chain security tooling to flag anomalous behavior before it reaches developer laptops.
Regardless of the lineage, the technique of using fake, highly realistic console output to phish sudo and conceal network‑delivered payloads is likely to be reused and refined in future npm‑based attacks.
| package_name | version | SHA1 |
| react-performance-suite | 2.0.0 | bdffc2f98ff422db9f9ddc190401cfcb686e3c32 |
| react-performance-suite | 2.0.1 | 5928e3121f12f3c5d690bc7968b28b2f67835ef5 |
| react-state-optimizer-core | 1.0.0 | cbe7c87293de7ab5853e2aef3f638d54c45f5c9f |
| react-state-optimizer-core | 1.0.2 | 1b4916fd65934f2f9efa7125335a85c104e1e17c |
| react-state-optimizer-core | 1.0.3 | 32d6b0b70ba825456471fab82119980de01e57d0 |
| react-state-optimizer-core | 1.0.4 | a5d4a4dbf036e4d7a5453db191f6e4320f604446 |
| react-state-optimizer-core | 1.0.5 | be10e30cf25d57385c31281219daf87dc7921da6 |
| react-state-optimizer-core | 1.0.6 | 874919fbd4e23da4f959447acf394a619cc23f72 |
| react-state-optimizer-core | 1.0.7 | 7562690617de6eafe29c3f1d83c029ee73b9f50b |
| react-state-optimizer-core | 1.0.8 | b75fc27053819cd2e7f5cfe193a91844c199c285 |
| react-state-optimizer-core | 1.0.9 | f9400843b42f0187e826e4c7a9786b0f09ab8992 |
| react-state-optimizer-core | 3.0.3 | fe6ee1104c4b02be39819822ed959039ea313e67 |
| react-state-optimizer-core | 3.0.4 | dc8ee405dd4402addae67ba6546f4f3781d7bdec |
| react-state-optimizer-core | 3.0.5 | 84aab614cf6ad92b5498398e914a8f22056722d8 |
| react-state-optimizer-core | 3.0.6 | a1cff6b52b7bfc61d08360af364ff7a4b4b2c504 |
| react-state-optimizer-core | 3.0.7 | 22ada4f5a95fd9b5edb76426b7dddb168145fda7 |
| react-state-optimizer-core | 3.0.8 | 729fbce89101f8f79a57189e89a7e63ee7d61388 |
| react-state-optimizer-core | 3.0.9 | befa10ca40c2923390db04eb34391c32aa29e611 |
| react-fast-utilsa | 2.0.1 | e6cfaef4b50d2a4ddd8453bf5a91e81a092d6e09 |
| react-fast-utilsa | 2.0.2 | 56b78d2027cbf7b40dcbd10f17462cd029d13dda |
| react-fast-utilsa | 2.0.3 | 1d92c73a859096cf107d11c4acd089f7b4e61a5b |
| react-fast-utilsa | 2.0.4 | 6169a0bc69c94f3a5c13d899ac612d2fabe98611 |
| ai-fast-auto-trader | 2.2.1 | 963b79f59fb2c070a06b9a2af9db2b5512c1ed74 |
| ai-fast-auto-trader | 2.2.2 | 1ac0d6fac272903eb83a885a40c6ce5b2656b6f3 |
| ai-fast-auto-trader | 2.2.3 | d1a1f76cce48be58e5d72f31ba54e4e2372848ea |
| ai-fast-auto-trader | 2.2.4 | f579b2d0b65a3a3cb52be535a591bc8d0f1077b7 |
| ai-fast-auto-trader | 2.2.5 | 870636bcf3d2c0b9c4c12809a19af153ef154260 |
| ai-fast-auto-trader | 2.2.6 | d22eb34facf13b5c1e820d9e6358eb4cd3797eaa |
| pkgnewfefame1 | 3.2.1 | 2a8c625660ad6bb7d7c953a147c84c0fcc75794b |
| carbon-mac-copy-cloner | 1.1.0 | 63783f6e59d20e2c664123b349f22dd53d1293d4 |
| carbon-mac-copy-cloner | 1.1.1 | 60c88674128680b7e474607ba0fb8020c141ac71 |
| carbon-mac-copy-cloner | 1.1.10 | b70a40b199d9a3cbbebfb0c1148b110acf3ec4eb |
| carbon-mac-copy-cloner | 1.1.2 | 59ca6306e77eb7f93528016dca14964968556310 |
| carbon-mac-copy-cloner | 1.1.3 | 6c17eccf82c7d85a883dfa7feac0be835f827fe3 |
| carbon-mac-copy-cloner | 1.1.4 | fb147ad540ae975228f8fe7d7fb557ff0670f69f |
| carbon-mac-copy-cloner | 1.1.5 | c486f9be10e6db40b8c30c8053dd44a6b2ac867e |
| carbon-mac-copy-cloner | 1.1.6 | e91baf3d270a21948833c50da1f0345d20ee1ec7 |
| carbon-mac-copy-cloner | 1.1.7 | 43a361eec666edab60f0e95740cf9e51c06106bc |
| carbon-mac-copy-cloner | 1.1.8 | bc3c787cf2b768f0a021fc3ca4fde65658a3f9e5 |
| carbon-mac-copy-cloner | 1.1.9 | 6d115186018b396ea62afce46d6616957bf3d7c0 |
| carbon-mac-copy-cloner | 1.2.1 | 4439720f0722d3c92615114f1099471efd280feb |
| coinbase-desktop-sdk | 1.5.14 | cb9208d756dc4d4674801611d8d5f5ba79e76366 |
| coinbase-desktop-sdk | 1.5.15 | 34ba816adda6ab74d0f4bbb04fdb8ed49b1137bb |
| coinbase-desktop-sdk | 1.5.16 | 46e034baab242c110355eba0937d9e505232e8dc |
| coinbase-desktop-sdk | 1.5.17 | c02624f8cefe790b6dee529c7a0e97f4241d79ed |
| coinbase-desktop-sdk | 1.5.19 | d5ade32ac52140e6c25f50780dc4ff4d466faddb |
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
A December intrusion to Storm-2603, the China-based group Microsoft ties to Warlock ransomware. The attackers…
A decade-old authentication bypass in OpenSSH on musl-based Linux lets attackers log into accounts that…
Bitdefender researchers have revealed a vulnerability called GhostMap that affects Android devices. This vulnerability can…
Microsoft has announced a vulnerability in Windows Paint that could let unauthenticated attackers execute malicious…
An autonomous penetration-testing framework linked to South Korean banking breaches and cloud supply-chain attacks is…
Shopify is making IP allowlisting mandatory for all public apps to limit abuse of stolen…