Hackers Deploy Weaponized npm Packages to Target React and Node.js JavaScript Frameworks
Socket's Threat Research Team has detected a series of malicious npm packages in the JavaScript ecosystem, active for over two years with more than 6,200 downloads.
Socket's Threat Research Team has detected a series of malicious npm packages in the JavaScript ecosystem, active for over two years with more than 6,200 downloads.
These packages target popular frameworks such as React, Vue.js, Vite, Node.js, and the Quill Editor. They were created by a threat actor using the npm alias "xuxingfeng" (associated with the email 1634389031@qq[.]com).
Disguised as legitimate plugins and utilities, these packages carry destructive payloads that can corrupt data, delete critical files, and trigger system shutdowns.
Despite efforts to remove them, these packages remain active on the npm registry , posing an ongoing risk to developers and organizations worldwide.
Malware Campaign Uncovered After Two Years
The campaign's sophistication lies in its strategic deception and multi-vector attack approach. The attacker used typosquatting and naming mimicry to exploit developers' trust and reliance on autocomplete tools.
By also publishing non-malicious packages under the same alias, the threat actor built a facade of credibility, making the harmful ones harder to detect.
These packages target popular frameworks such as React, Vue.js, Vite, Node.js, and the Quill Editor.
Targeting high-value tools like Vite, these packages were designed to infiltrate real-world applications, CI/CD pipelines, and production environments, ensuring maximum damage.
The payloads vary from subtle data corruption (e.g., in packages like "js-hood") to aggressive file deletion (e.g., in "vite-plugin-bomb"). Others perform advanced client-side attacks, corrupting browser storage mechanisms and breaking authentication tokens and user data.
The campaign uses technical design and concealment tactics such as timed activation and randomized execution intervals to avoid detection.
Minified code and robust error handling further obscure their malicious intent. Dynamic path resolution ensures successful attacks regardless of installation location.
Organizations are advised to audit dependencies, restore environments from trusted sources, rotate credentials, and use tools like Socket’s AI Scanner to detect supply chain risks in real-time.
Category Details
Malicious Packages js-bomb, js-hood, vite-plugin-bomb-extend, vite-plugin-bomb, vite-plugin-react-extend, vite-plugin-vue-extend, vue-plugin-bomb, quill-image-downloader
Threat Actor Identifiers npm Alias: xuxingfeng
npm Registration Email: 1634389031@qq[.]com
Based on reporting by GBHackers.