Malicious npm packages imitate internal company namespaces

Microsoft’s report describes packages published on 28 and 29 May under scopes resembling internal corporate namespaces. Some included plausible enterprise repository and documentation metadata. Researchers said the packages shared an install-time component and infrastructure associated with an obfuscated reconnaissance payload.

The payload collected system and developer-environment information, including host and environment details. The technique differs from merely using a misspelled popular package name: it tries to exploit how a build resolves something believed to be internal. Teams assessing the report need to examine which package was resolved and what ran during installation. A convincing namespace or repository link in package metadata does not verify who controls the published package.