---
title: Hackers Hijack Toptal's GitHub to Spread Malicious npm Packages
description: Cybercriminals compromised Toptal's GitHub, publishing 10 malicious npm packages that stole tokens and wiped systems. Attack method unknown; Toptal has restored safe versions. Learn more about this supply chain attack.
canonical_url: https://codekeeper.co/ticker/hackers-hijack-toptals-github-to-spread-malicious-npm-packages
---

[Cyberattacks](https://codekeeper.co/ticker/tag/cyberattacks)

# Hackers Hijack Toptal's GitHub to Spread Malicious npm Packages

Cybercriminals compromised Toptal's GitHub, publishing 10 malicious npm packages that stole tokens and wiped systems. Attack method unknown; Toptal has restored safe versions. Learn more about this supply chain attack.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jul 28, 2025

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Cybercriminals compromised Toptal's GitHub account and published 10 malicious npm packages that downloaded 5,000 times before removal. The packages contained code designed to steal GitHub authentication tokens and completely wipe victim systems using destructive commands. All packages targeted the same preinstall and postinstall scripts, sending stolen data to webhook endpoints before silently deleting files on Windows and Linux machines. Toptal has since restored safe versions, but the attack method remains unknown. This follows similar supply chain attacks targeting npm and Python repositories with surveillanceware. Source: [The Hacker News](https://thehackernews.com/2025/07/hackers-breach-toptal-github-publish-10.html)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fhackers-hijack-toptals-github-to-spread-malicious-npm-packages%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[Cyberattacks Hackers Clone Trusted Websites to Chain Chrome and Windows Zero-Days in Espionage Campaign Sep 23, 2026](https://codekeeper.co/ticker/china-hackers-exploit-chrome-windows-target-governments)

[Vulnerabilities Attackers Are Firing a Public Exploit at a Critical SharePoint Auth Bypass Aug 13, 2026](https://codekeeper.co/ticker/critical-sharepoint-vulnerability-cve-2026-55040)

[Cyberattacks Boston Scientific Hit by Cyberattack, Order Processing Disrupted Aug 28, 2026](https://codekeeper.co/ticker/boston-scientific-cyberattack-disrupts-operations)

[Cyberattacks Vulnerable Children's Health Data Exposed in Cyber Attack — Families Told 18 Months Later Sep 23, 2026](https://codekeeper.co/ticker/vulnerable-childrens-health-data-leak-hcrg)