Open-source malware registry OSM flagged two critical npm packages — @zmtcdn/ui and @zmtcdn/components — for data exfiltration and install-time execution, with dependency-confusion indicators matching the pattern of a campaign family that also surfaced this week in fetch-hash-cache-atomic and several @s4yhiitestpoc packages. No OSV advisory was listed for the zmtcdn pair, so detection rests on registry vetting rather than a CVE. Dependency-confusion remains the cheapest supply-chain attack available: an attacker publishes a name that resolves in a private registry before the public one or mirrors a real component, and build pipelines pull the attacker's copy. Australian engineering teams should re-check npm scopes, private-registry resolution order and lockfile integrity — and treat any install-script behaviour in these namespaces as malicious until proven otherwise.

• Source article