DeceptiveDevelopment poisons repos after stealing developer credentials
ESET says the group planted code on npm, PyPI, Packagist, Go modules, and extension stores from April to September 2026.
76
Threat actor
DeceptiveDevelopment
- Mentions · 7d2
- Mentions · 30d2
- All mentions2
- First seenOct 28, 2026
- Last mentioned5h ago
Timeline
2 articles · newest firstESET maps APT activity from April through September 2026
China-, Iran-, North Korea- and Russia-aligned groups hit governments, semiconductors, drones, crypto firms and Ukraine.
72
Appears with
- ESETorganization · 2
- MuddyWaterthreat actor · 1
- PteroBoxmalware · 1
- DEV#POPPERmalware · 1
- MDaemonproduct · 1
- VS Codeproduct · 1
- OilRigthreat actor · 1
- Lazarusthreat actor · 1
- Arid Viperthreat actor · 1
- PteroPSDoormalware · 1
- FamousSparrowthreat actor · 1
- Rezzuarmalware · 1
- PrincessSpymalware · 1
- SlippyNunchucksthreat actor · 1
- ScarCruftthreat actor · 1
- OmniStealermalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.