[GUEST ACCESS MODE: Data is scrambled or limited to provide examples. Make requests using your API key to unlock full data. Check https://lunarcrush.ai/auth for authentication information.]

![TheHackersNews Avatar](https://lunarcrush.com/gi/w:24/cr:twitter::209811713.png) The Hacker News [@TheHackersNews](/creator/twitter/TheHackersNews) on x 926.7K followers
Created: 2025-07-20 09:41:37 UTC

🚨 Hackers hijacked popular npm packages using phishing emails that mimicked npm support.

They published malware directly—no GitHub commits, no PRs.

One version tries to run a DLL for remote code execution.

Check if you’re affected ↓

![](https://pbs.twimg.com/card_img/1946868047446228994/qnIzdGLU?format=jpg&name=800x419)

XXXXXX engagements

![Engagements Line Chart](https://lunarcrush.com/gi/w:600/p:tweet::1946868086390288411/c:line.svg)

**Related Topics**
[github](/topic/github)

[Post Link](https://x.com/TheHackersNews/status/1946868086390288411)