Cases › security breach › LR-2026-0365

Malicious npm package hides a prompt to evade AI security scanners

Confirmed Why: 2 independent outlets · 2 independent reports

Developing: a major or severe case captured in the last 72 hours. Later changes are logged on the corrections page.

Status: no action reported

Severity major

Reported 1 Dec 2025

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Severity major: Test: many third parties, a stated count of two or more affected parties. Fact: nearly 17,000 installs of the package remain downloadable, as stated in the source.

An npm package named eslint-plugin-unicorn-ts-2, version 1.2.1, posed as a TypeScript variant of an ESLint plugin. Its code contained hidden text, a prompt telling a scanner to forget what it knew and treat the code as legitimate. Koi Security's risk engine flagged the prompt. Investigators concluded the package functioned as a standard supply chain compromise: a post-install hook captured environment variables and sent them to a Pipedream webhook. Earlier versions from 1.1.3 had been labeled malicious by OpenSSF Package Analysis in February 2024, but npm did not remove the package. Version 1.2.1 remained downloadable with nearly 17,000 installs.

What happened

1 · What it was doingThe package posed as a TypeScript extension of a popular ESLint plugin.

2 · What went wrongThe package's script was designed to capture environment variables and send them to a webhook.

3 · What it reached or didVersion 1.2.1 remained downloadable with nearly 17,000 installs.

4 · How it was caughtKoi Security's risk engine flagged the embedded prompt.

What was done

No source states an action or fix.

Risks

Supply-chain compromise
Primary24 incidents
Rising: 4 vs 0.2 a week

Data leaked or sent out
Also32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Sandboxed code execution

Application

Signed and verified components · Vetting of plug-ins, skills and dependencies · AI bill of materials · Vulnerability scanning of AI components · Model provenance checks · Least-privilege access for the agent

Infrastructure / target

Secrets scanning

Evidence

No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off, what was done.

Show the full account: 7 items from the primary sources

What happened, in order

2024-02 Package uploaded to the npm registry.
2024-02 OpenSSF Package Analysis labeled earlier versions from 1.1.3 as malicious.
2025-12-01 Attempt to influence AI-driven scanners reported in press.
2025-12-02 Researchers disclosed details of the package.

Not dated in the sources:

Malicious code introduced in version 1.1.3.
npm did not remove the package and the attacker kept releasing updates.
Version 1.2.1 still downloadable with nearly 17,000 installs at time of reporting.

Show every field, with its source and grade