---
id: 2532
title: "Hide and Fail: Obfuscated Malware, Empty Payloads, and npm Shenanigans"
source_domain: aikido.dev
source_url: "https://www.aikido.dev/blog/hide-and-fail-obfuscated-malware-and-npm-shenanigan"
published_at: "2025-04-03 00:00"
tags: ["rce", "supply-chain", "malware", "npm", "obfuscation", "aikido", "eval", "threat-analysis", "npm-malware", "fake-packages", "nodemailer"]
phying_url: "https://phying.com/item/2532"
lang: en
---

# Hide and Fail: Obfuscated Malware, Empty Payloads, and npm Shenanigans

## Summary

npm package node-facebook-messenger-api hid RCE logic behind axios, eval(), and an empty Google Docs payload; the same actor later shipped a fake nodemailer clone with equally conspicuous obfuscation.

## Intelligence Metadata

- **Sources:** aikido.dev
- **Published:** 2025-04-03 00:00
- **Original:** https://www.aikido.dev/blog/hide-and-fail-obfuscated-malware-and-npm-shenanigan
- **Phying News:** https://phying.com/item/2532