Detect and remove the NullReceiver / 'jsbot' npm supply-chain worm on developer machines (macOS + Linux). Covered packages: tailwindcss-motion-advanced, envpack-conf, postcss-initial-provider, agentgui, godot-kit, fluid-type-ui, bianira-ui, @kolbo/mcp. Single file, stdlib only, offline.
macos lazarus npm detection incident-response malware supply-chain infosec yara security-tools contagious-interview nullreceiver
-
Updated
Oct 5, 2026 - JavaScript