Tracked campaign · npm

Clob dropper

Three npm packages from publisher devcarron shipping identical postinstall droppers fetching a Windows PE via IPFS within a 4-minute burst.

1,943 packages attributednpm ecosystempkgradar source

First seen 2025-05-25

Attribution basis

These are the signal classes linking the members of this campaign — the broad evidence categories we use to attribute a package, not the raw indicators themselves.

shared malware fingerprint
OSV advisory cluster
shared publisher account

Sample attributed packages

seshmux@0.4.2
@secaudita10x/sec-test-r7ghosts@1.0.0
c8-lib-service-ui@2.0.22
@secauditb20y/sec-test-r3b@1.0.0
getenvguard@1.0.4
trimprompt@1.0.41
apify-cli@1.7.2-beta.6
trimprompt@1.0.40
trimprompt@1.0.39
trimprompt@1.0.38
trimprompt@1.0.37
@hasna/browser@0.5.16
@lark-codem/codem-core-linux-x64-musl@0.7.72
@lark-codem/codem-core-linux-x64-musl@0.7.73
@lark-codem/codem-core-linux-arm64-musl@0.7.72
@lark-codem/codem-core-linux-x64-gnu@0.7.72
@lark-codem/codem-core-linux-arm64-musl@0.7.73
@lark-codem/codem-core-linux-x64-gnu@0.7.73
@lark-codem/codem-core-darwin-x64@0.7.73
@lark-codem/codem-core-linux-arm64-gnu@0.7.72
@lark-codem/codem-core-darwin-x64@0.7.72
@lark-codem/codem-core-darwin-arm64@0.7.73
@lark-codem/codem-core-darwin-arm64@0.7.72
@lark-codem/codem-core-linux-arm64-gnu@0.7.73
apify-cli@1.7.2-beta.5
@fleetbo/svro@0.0.21
@fleetbo/svro@0.0.20
@fleetbo/svro@0.0.24
@fleetbo/svro@0.0.23
@fleetbo/svro@0.0.22

PkgRadar attributes coordinated supply-chain campaigns and blocks their packages at the CI gate. Start free or see all tracked campaigns.