Russian AI Slopsquatting Publishes 700+ Malicious NPM Packages

Reported 07 Aug 2026 by otx · Severity: medium

A threat actor published over 700 malicious packages to the NPM registry within 48 hours using AI-generated typo-squatting package names. These packages deploy a cross-platform RAT and infostealer without requiring install scripts, executing immediately upon import via require().