AI Supply-Chain Compromise
A malicious npm package, `eslint-plugin-unicorn-ts-2`, engaged in typosquatting to exfiltrate environment variables via a post-install hook to a Pipedream webhook. This malware also incorporated a novel tactic of embedding deceptive prompts to manipulate LLM-based security scanners, aiming to evade automated detection of the supply chain compromise.
What Happened
A malicious npm package, `eslint-plugin-unicorn-ts-2`, engaged in typosquatting to exfiltrate environment variables via a post-install hook to a Pipedream webhook. This malware also incorporated a novel tactic of embedding deceptive prompts to manipulate LLM-based security scanners, aiming to evade automated detection of the supply chain compromise.
Why This Matters
The evidence matters to defenders using the affected technology because it may place downstream environments at risk through compromised dependencies.
Recommended Action
No confirmed vendor remediation is available in the current evidence. Confirm whether the affected technology is present in your environment and review the affected configuration.
Exposure
Exposure unknown
Dec 01, 2025 05:30
Exposure reason: This incident does not currently match a technology in My AI Stack.
Exploitation status: UNKNOWN
Primary entities:
Timeline
-
Incident first seen
Dec 01, 2025 05:30BugSkan first recorded this incident.
-
Malware Manipulates AI Detection in Latest npm Package Breach - Infosecurity Magazine
Dec 01, 2025 05:30infosecurity-magazine.com · Research
Sources
infosecurity-magazine.com · Dec 01, 2025 05:30
A malicious npm package, `eslint-plugin-unicorn-ts-2`, engaged in typosquatting to exfiltrate environment variables via a post-install hook to a Pipedream webhook. This malware also incorporated a novel tactic of embedding deceptive prompts to manipulate LLM-based security scanners, aiming to evade automated detection of the supply chain compromise.
Open publisher sourceMy AI Stack Match
Create an account to see which incidents overlap with your AI stack.