Packagist packages hid malicious package.json scripts, enabling Linux binary execution during installs and workflows.

Ghostwriter used Prometheus lures since spring 2026 to target Ukraine agencies, enabling malware delivery and data theft.