It seems there are ~110 automatic scanners running on every upload to npmjs[.]com
Because that's how many downloads every single revision of the package I publish there, that I also believe myself to be the only user of, has. No matter how briefly that specific version is the latest.
With that in mind it's quite strange that I don't see a single probe towards the asset one of the uploads leaked an access token to.
Today's hackers ...
Troed Sångberg
npub192…vy8wk
2026-06-18 10:40:10 UTC
Author Public Key
npub192kepsf3ypyzgsds9r93amadzta0efs05ftuxhl84m04e9xxhy9qevy8wkPublished at
2026-06-18 10:40:10 UTCEvent JSON
{
"id": "86a26f775792bb052a47d36c9d9300dd83210912047a060a131f4bc1013e1622",
"pubkey": "2aad90c13120482441b028cb1eefad12fafca60fa257c35fe7aedf5c94c6b90a",
"created_at": 1781779210,
"kind": 1,
"tags": [
[
"proxy",
"https://swecyb.com/@troed/116770682351964717",
"web"
],
[
"proxy",
"https://swecyb.com/users/troed/statuses/116770682351964717",
"activitypub"
],
[
"L",
"pink.momostr"
],
[
"l",
"pink.momostr.activitypub:https://swecyb.com/users/troed/statuses/116770682351964717",
"pink.momostr"
],
[
"-"
]
],
"content": "It seems there are ~110 automatic scanners running on every upload to npmjs[.]com\n\nBecause that's how many downloads every single revision of the package I publish there, that I also believe myself to be the only user of, has. No matter how briefly that specific version is the latest.\n\nWith that in mind it's quite strange that I don't see a single probe towards the asset one of the uploads leaked an access token to.\n\nToday's hackers ...",
"sig": "9727ea450702526150a13080a96795914cc358b092bd296d811f5077c6fbea00eb535798da8d439d4bd80f1a292bd105c59f3cb9cc0856cb5ac261c5e00b0c58"
}