TGTGInsighttelegram intelligenceLIVE / telegram public index
TGINSIGHT POST
Post #8666
@thehackernews
The Hacker News
Post content
Post content
🚨 Attackers are abusing npm and GitHub to deliver malware disguised as dev tools. Sudo password phishing during install triggers a multi-stage chain that deploys a RAT, stealing crypto wallets, credentials, SSH keys, and tokens. 🔗 Read → https://thehackernews.com/2026/03/ghost-campaign-uses-7-npm-packages-to.html