New.

ReversingLabs: Fake install logs in npm packages load RAT https://www.reversinglabs.com/blog/npm-fake-install-logs-rat

More:

The Hacker News: Ghost Campaign Uses 7 npm Packages to Steal Crypto Wallets and Credentials https://thehackernews.com/2026/03/ghost-campaign-uses-7-npm-packages-to.html @thehackernews #infosec #npm #phishing #javascript

Malicious npm packages use fake install logs to load RAT | ReversingLabs

The final-stage malware in the Ghost campaign is a RAT designed to steal crypto wallets and sensitive data.

ReversingLabs