How the Attack Unfolded
A sophisticated malware campaign targeting software developers has been discovered in the npm package ecosystem. The malicious package, named forge-jsxy, was published to the npm registry on May 4, 2026, and rapidly evolved through 22 versions over the following 22 days. This high velocity of updates represents one of the most actively maintained supply chain attacks observed on the platform.
Security researchers at SafeDep identified that the attack was a continuation of an earlier campaign using a predecessor package called forge-jsx, which had been published on April 7, 2026, and ran undetected for nearly a month. When npm took down the original package and replaced it with a security placeholder, the attacker created a new account and published forge-jsxy, resuming development exactly where it had stopped. The command-and-control infrastructure, encryption methods, and session credentials matched across both packages, confirming the same operator was behind the entire campaign.
Malware Capabilities and Development Discipline
To avoid suspicion, the package disguised itself as a legitimate Node.js integration layer for Autodesk Forge, a well-known software development kit. However, once installed, a postinstall script activated a hidden agent that began harvesting keystrokes, clipboard content, environment files, shell history, and desktop screenshots. Notably, the malware deliberately skipped continuous integration environments to avoid detection during automated builds.
The development of forge-jsxy progressed through five distinct phases. The initial versions carried the full feature set from the predecessor package, including periodic desktop screenshots sent to Discord through rotating bot webhooks. A second phase introduced a web based file explorer, enabling remote browsing of victim file systems. By mid-May, the attacker added WebRTC peer-to-peer data channels, creating a faster communication path that bypassed traditional command channels.
Over 50 days of combined activity across both package names, the operator shipped 88 total versions and built an extensive feature set. What makes this campaign particularly notable is the attacker’s unusual discipline: they maintained test coverage throughout the project, growing the test suite from 12 files to 20 files by the final version, a level of rigor rarely seen in npm supply chain attacks.
Source: Cyber Security News
