Hackers Using Weaponized npm Packages to Attack React, Node.js JavaScript Frameworks

Security researchers have uncovered a supply chain attack targeting JavaScript frameworks via malicious npm packages, accumulating over 6,200 downloads. The attacker, using the alias “xuxingfeng,” published both legitimate and harmful packages, including those employing typosquatting to target popular tools like Vite, React, and Vue.js plugins. Notably, the "js-hood" package corrupts core JavaScript methods, leading to subtle data corruption and unpredictable application behavior, making debugging difficult; experts recommend auditing dependencies, restoring from verified sources, and rotating compromised credentials.

Analysis

A sophisticated supply chain attack has been identified within the JavaScript ecosystem, where malicious npm packages, downloaded over 6,200 times, are targeting popular frameworks like Vite, React, and Vue.js. The threat actor, operating under the alias “xuxingfeng,” employed a dual strategy, publishing both benign and harmful packages to build a facade of legitimacy, with eight malicious packages reportedly still active on the npm registry as of May 22, 2025. These packages utilize typosquatting and name mimicry, such as “vite-plugin-react-extend” mimicking “@vitejs/plugin-react,” to deceive developers. A particularly insidious package, “js-hood,” is designed to corrupt fundamental JavaScript APls, including Array methods (e.g., filter, push, map) and String methods (e.g., split, replaceAll), causing them to return random, unpredictable values at randomized 5-10 minute intervals after August 1, 2023. This subtle data corruption, as opposed to overt system damage, leads to hard-to-diagnose intermittent application failures, posing a significant threat to software integrity and reliability for projects relying on these widely used tools, including Vite which has over 28 million weekly downloads. The campaign demonstrates a multi-faceted threat with varied attack vectors ranging from data corruption to file deletion and system crashes, underscoring critical vulnerabilities in the open-source software supply chain.

Key Decisions for Investors

• Investors should scrutinize the cybersecurity posture and supply chain risk management practices of software companies, particularly those heavily reliant on the JavaScript ecosystem and npm packages, given the demonstrated vulnerabilities.
• Consider potential headwinds for companies whose products or services could be significantly impacted by such difficult-to-detect software corruption, potentially leading to reputational damage or operational disruptions.
• Evaluate opportunities in cybersecurity firms specializing in software supply chain security, code auditing, and threat detection, as demand for such solutions is likely to increase following these revelations.