The popular NPM package 'is' has been compromised in a supply chain attack that injected backdoor malware, giving attackers full access to compromised devices. This occurred after maintainer accounts were hijacked via phishing, followed by unauthorized owner changes that went unnoticed for several hours, potentially compromising many developers who downloaded the new releases. The 'is' package is a lightweight JavaScript utility library that provides a wide variety of type checking and value validation functions. The software has over 2.8 million weekly downloads on the NPM package index. It is used extensively as a low-level utility dependency in development tools, testing libraries, build systems, and backend and CLI projects. On July 19, 2025, the package's primary maintainer, John Harband, announced that versions 3.3.1 through 5.0.0 contained malware and were removed roughly 6 hours after threat actors submitted them to npm.
This was the result of the same NPM supply chain attack that used the fake domain' npnjs[.]com' to snatch maintainer credentials and then publish laced versions of popular packages. Besides 'is,' the following packages were confirmed to be pushing malware, compromised in the same attack: Socket reports that 'is' contains a cross-platform JavaScript malware loader that opens a WebSocket-based backdoor, enabling remote code execution. "Once active, it queries Node's os module to collect the hostname, operating system, and CPU details, and captures all...