Daily Briefing for 09.09.25

Top stories.

• Major npm supply chain attack has been largely averted.
• Attackers send phishing messages via iCloud Calendar invites.
• US Treasury sanctions Southeast Asian scam networks.

Major npm supply chain attack has been largely averted.

Attackers launched a widespread supply chain attack yesterday after hacking an npm developer's account, though the campaign isn't as serious as some initial reports suggested, Infosecurity Magazine reports. Package maintainer Josh Junon confirmed yesterday that his npm account was compromised after he received a phishing email posing as a 2FA reset notification. The hackers then used Junon's "qix" npm account to publish malicious versions of dozens of packages Junon had maintained, which collectively receive more than 2.6 billion weekly downloads. The malicious code monitored the user's web browser for cryptocurrency addresses and replaced them with attacker-controlled addresses.

Less than four hours after Junon disclosed the hack, npm confirmed that all the malicious package versions had been shut down. Observers say the quick response highlighted the strength of the open-source security model. Arda Büyükkaya from EclecticIQ notes that npm recorded zero downloads of the malicious packages, and the attacker's cryptocurrency account currently has a balance of only sixty-six dollars.

Attackers send phishing messages via iCloud Calendar invites.

BleepingComputer warns that attackers are abusing iCloud Calendar invites to send callback phishing messages that come from Apple's email servers. The notifications posed as invoices informing users of a six-hundred-dollar charge from their PayPal account. BleepingComputer explains, "[T]his email is actually an iCloud Calendar invite, where the threat actor included the phishing text within the Notes field and then invited a Microsoft 365 email address that they controlled. When the iCloud Calendar event is created and external people are invited, an email invitation is sent from Apple's servers at email.apple.com from the iCloud Calendar owner's name with the email address 'noreply@email.apple[.]com.'"

Aside from abusing Apple's infrastructure, the phishing attack is fairly generic. Users should always be wary of unexpected, urgent-sounding messages encouraging them to click a link, call a number, or open an attachment.

US Treasury sanctions Southeast Asian scam networks.

The US Treasury Department has imposed sanctions on companies and individuals allegedly involved in large scam networks in Southeast Asia, Reuters reports. Treasury said the action "includes nine targets operating in Shwe Kokko, Burma, a notorious hub for virtual currency investment scams under the protection of the OFAC-designated Karen National Army (KNA), as well as ten targets based in Cambodia."

The scam compounds, particularly along the Thai-Myanmar border, are known for using forced labor and debt slavery to compel thousands of human-trafficking victims into carrying out online scams. The Treasury Department says these networks stole more than $10 billion from Americans last year.