dev.to/tag/security· Oct 26, 2026· by Mag Solutions

One npm account, 14 packages, four scopes: a dependency-confusion campaign built to look like someone's internal SDK

Between 21:23 UTC on 23 October 2026 and 14:28 UTC on 25 October 2026, an npm account called wiseke published 14 packages across four scopes: @greenlake, @sxm-web, @drone-js-ext and @ppa-web-components. On 26 October, GitHub's Advisory Database reviewed all of them as malware, @greenlake/auth, @greenlake/context-pane, @greenlake/mfe-login-url and @sxm-web/client-sdk-core. Each advisory Scoped names like @greenlake/auth or @greenlake/mfe-login-url read like the internal packages All four advisori

🎯 Vulnerability: Web Security Vulnerability

💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.

#security#javascript#ai

One npm account, 14 packages, four scopes: a dependency-confusion campaign built to look like someone's internal SDK

More Writeups Like This

Rendering LLM output in a VS Code webview without trusting it

items-validator and item-validator: three weeks old and six years dormant, flagged as malware the same morning

Security Regression Gate Sentinel — block the rise, not the presence

A package labelled itself "SECURITY RESEARCH." GitHub flagged it as malware anyway.