Cybersecurity researchers have uncovered a coordinated wave of software supply chain attacks involving malicious packages published to both NuGet and npm registries, designed to steal sensitive credentials from developers and enterprise environments.
The campaign includes a compromised NuGet package posing as a legitimate banking SDK, alongside multiple npm packages targeting cloud infrastructure secrets, CI/CD tokens, and developer authentication data.
Fake Sicoob SDK Used to Steal Banking Certificates
Security researchers identified a malicious NuGet package named “Sicoob.Sdk”, which impersonates a software development kit for Sicoob, one of Brazil’s largest cooperative financial institutions.
The affected versions (2.0.0 to 2.0.4) were found to contain hidden functionality that extracts sensitive authentication data, including:
- Client IDs used for API access
- PFX certificates used for banking authentication
- PFX passwords stored locally by developers
Once installed, the package reportedly reads certificate files from disk, encodes them, and transmits the data to an external endpoint controlled by attackers.
The stolen credentials could enable attackers to impersonate legitimate financial integrations, potentially allowing unauthorized financial operations such as automated payments and QR code generation.
Additional Data Exposure Through Payment APIs
Researchers also found that the malicious SDK captures responses from Boleto payment APIs, a widely used payment method in Brazil for invoices and transactions.
This data may expose:
- Transaction amounts
- Payment statuses
- Due dates
- Payer and recipient information
Security experts warn that compromised API credentials could lead to downstream financial fraud and unauthorized access to banking systems.
Following disclosure, the package was removed from the NuGet registry, and associated accounts distributing similar packages have been flagged.
npm Supply Chain Campaign Targets Cloud and DevOps Secrets
In a separate but related campaign, researchers discovered 14 malicious npm packages designed to impersonate legitimate DevOps and cloud configuration tools.
These packages were published by a single threat actor and were engineered to harvest:
- AWS credentials
- HashiCorp Vault tokens
- npm authentication tokens
- CI/CD pipeline secrets
- Environment variables
The malware was executed through preinstall hooks, enabling it to run before normal package installation completes—making detection significantly more difficult.
Typosquatting and Brandjacking Across the Ecosystem
The malicious npm packages used naming strategies designed to mimic trusted tools in cloud and DevOps environments, including OpenSearch and Elastic-related utilities.
Additional findings show:
- Hundreds of related malicious packages across multiple campaigns
- Use of high version numbers to trick dependency resolution systems
- Credential harvesting scripts triggered automatically during installation
- Distribution of second-stage payloads after initial compromise
Researchers also reported campaigns involving:
- Credential and environment variable exfiltration
- Host system fingerprinting
- Clipboard and file scanning in advanced variants
- Abuse of npm as a hosting mechanism for malicious content
Attackers Moving Beyond Simple Typosquatting
Security analysts note that threat actors are evolving beyond basic misspelled package names. Instead, they are now using realistic naming conventions that resemble legitimate enterprise tooling.
According to recent industry findings, attackers increasingly:
- Blend malicious packages into normal developer workflows
- Use trusted-looking project names
- Exploit automation in CI/CD pipelines
- Leverage dependency confusion techniques
This shift turns routine package installation into a high-risk entry point for enterprise compromise.
Security Guidance for Developers and Organizations
Experts recommend immediate defensive actions:
- Remove any suspicious or unverified NuGet or npm packages
- Rotate all exposed credentials, including API keys and certificates
- Replace compromised PFX certificates and passwords
- Audit CI/CD pipelines and dependency trees for anomalies
- Monitor authentication logs for unusual API activity
- Restrict use of untrusted third-party packages in production environments
Broader Supply Chain Risk Continues to Grow
The incidents highlight a broader trend of increasing supply chain attacks targeting developers directly, rather than infrastructure endpoints.
Security researchers warn that open-source ecosystems remain a high-value target, as a single compromised package can expose thousands of downstream applications and enterprise systems.
