StepSecurity AI Package Analyst

Reported Context (4)

This compromise was detected through two independent signals: the StepSecurity AI Package Analyst, which flagged all three compromised versions with a Critical / Rejected verdict, identifying credential theft, env Malicious pgserve npm Releases Harvest Credentials and Spread to Other Packages
StepSecurity AI Package Analyst report: @usebioerhold8733/[email protected] Malicious React Native npm Releases Used a Solana-Based C2 for Malware Delivery
[email protected] is flagged as Critical by StepSecurity AI Package Analyst, which identified it as credential-stealing malware. The package is obfuscated with the J2TEAM obfuscator, which uses a rotating string array StepSecurity Traces Malicious Polymarket Bot to Hijacked GitHub Organization
On February 17, 2026, StepSecurity AI Package Analyst flagged something unusual: a sudden flood of version releases across several well-known @types/ packages on npm — including @types/mapbox__point-geometry, StepSecurity Traces Repeated npm Releases to a DefinitelyTyped Workflow Bug

Malware (4)

People (2)

Threat Actors (1)

MITRE ATT&CK (24)

Vendors (4)

Products (7)

Tools (3)

Industries (1)

Countries (2)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.