← Wednesday, September 30, 2026SecurityDeep dive

Nine fake npm packages spread a Linux worm through preinstall hooks

safedep.io 17 min read Editor score 7/10

The packages download and run a worm during installation, which installs a Tor-accessible backdoor disguised as a systemd font service. The chain highlights the risk of malicious dependencies executing on developer Linux machines.

What: Nine fake npm packages, published under one account, spread a Linux worm through preinstall hooks.
How: The hook downloads node.js via the Wayback Machine; the script fetches the worm, which installs a backdoor and propagates using SSH keys and npm tokens.
Why it matters: The chain shows how package-install scripts and exposed credentials can turn one compromised machine into a wider supply-chain incident.

The package hook downloads and runs scripts that install the worm’s backdoor. Sketched from the article's own text.

Read on safedep.io → Lobsters

Discussion

Discussion is not switched on yet. Use Note above to keep your own thoughts on this story.

Headline, summary, brief and diagram are written by a model from the source's own text; the link, byline and numbers come from the source. Read the original before relying on a claim.