npmjs[.]helpDomain
Reported by 2 independent sources · first reported by Group-IB · last reported
Last reported 4 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Shai-Hulud Campaign Evolution: Miasma, Hades, and AI Scanner Evasion“AiTM phishing (npmjs[.]help)”
-
Detecting the NPM Supply Chain Compromise Before It Spread“The attacker sent an email titled “Two-Factor Authentication Update Required” from the spoofed address [email redacted]@npmjs[.]help, urging the recipient to reset their MFA settings to maintain account access.”
Indicators reported together
named in the same reports- scanning[.]inin 1 report
- fulcio.sigstore[.]devin 1 report
- dc48b09b2a5954f7…a923cb4c0efein 1 report
- e1342a80d4b5e83d…180c93a4b17din 1 report
- c539766062555d47…a668975e275cin 1 report
- models.litellm[.]cloudin 1 report
- hxxps://api.anthropic[.]com/v1/apiin 1 report
- 185.7.81[.]108in 1 report
- hxxps://websocket-api2.publicvm[.]com/images/jpg-to-png.phpin 1 report
- websocket-api2.publicvm[.]comin 1 report
- hxxps://www.npmjs[.]help/loginin 1 report
- www.npmjs[.]helpin 1 report
Copy these 12 indicators · defanged
Thanks — we review every report.