The known npm packages in the REF8801 campaign number five across three different scopes, and the group's website has been online since March 2026. Compared with the packages SafeDep flagged in July, the ones documented by Elastic use new scopes and a different macOS payload. They also hijack coding-agent traffic to attacker-controlled servers, with zero CVEs involved.
Podden och tillhörande omslagsbild på den här sidan tillhör
AGORA Intelligence. Innehållet i podden är skapat av AGORA Intelligence och inte av,
eller tillsammans med, Poddtoppen.
