Malware Manipulates AI Detection in Latest npm Package Breach
· Source: infosecurity-magazine.com
In short
A malicious npm package named eslint-plugin-unicorn-ts-2 version 1.2.1 has been discovered containing hidden code designed to mislead AI-driven security scanners. The package uses typosquatting on a trusted ESLint plugin name and contains a prompt instructing LLM-based scanners to ignore its malicious nature. Despite being flagged as malicious in February 2024, the package remains available with nearly 17,000 installs, highlighting systemic issues in supply chain security.
Read Original Article — Read the full article on the publisher’s site.
In the issue of week 49, 2025: Agentic AI Orchestrates Supply Chains as Security and Governance Accelerate
Tags: malware, supply-chain, security, automation, detection, npm