Researchers have found 37 malicious packages on a public open-source registry whose names imitate popular observability and tracing libraries.
On install, the packages read environment variables and cloud credential files, then sent them to an attacker-controlled endpoint. Each package stayed live for under four hours before registry maintainers removed it.
Build pipelines that resolve dependencies without a lockfile were the most exposed, because a single mistyped name was enough to pull in the malicious version.
What to do
- Search lockfiles and build logs for the package names in the researchers' report.
- Rotate any cloud tokens available to affected build jobs.