SlowMist Flags CrossRegistry Supply Chain Attack as Dozens of Malicious Packages Hit Developers

SlowMist said its MistEye monitoring system has identified a cross-registry supply chain campaign in which attackers published more than 34 malicious packages and at least 384 associated versions across npm, PyPI, and Crates.io. The operation targets developers working in crypto and DeFi, as well as ecosystems including Solana, Sui/Move, and AI. According to SlowMist, the malware is designed to steal cryptocurrency wallets, SSH keys, cloud credentials, and other sensitive data. The campaign also attempts to maintain long-term access using multiple persistence techniques. SlowMist advised developers and organizations to remove any affected packages, isolate impacted machines, rotate exposed credentials, and rebuild development environments from clean images.