Cyberattacks

Hackers Hijack Toptal's GitHub to Spread Malicious npm Packages

Cybercriminals compromised Toptal's GitHub, publishing 10 malicious npm packages that stole tokens and wiped systems. Attack method unknown; Toptal has restored safe versions. Learn more about this supply chain attack.

By Content Team

Jul 28, 2025

ON THIS PAGE

Cybercriminals compromised Toptal's GitHub account and published 10 malicious npm packages that downloaded 5,000 times before removal. The packages contained code designed to steal GitHub authentication tokens and completely wipe victim systems using destructive commands. All packages targeted the same preinstall and postinstall scripts, sending stolen data to webhook endpoints before silently deleting files on Windows and Linux machines.

Toptal has since restored safe versions, but the attack method remains unknown. This follows similar supply chain attacks targeting npm and Python repositories with surveillanceware.

Source: The Hacker News

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?