---
id: 6703
title: "Still Trusting Automated Patches Blindly? Think Again"
source_domain: jfrog.com
source_url: "https://jfrog.com/blog/npm-automated-patching-breach/"
published_at: "2025-07-23T13:08:52Z"
tags: ["supply-chain", "malware", "npm", "phishing", "patch-management", "eslint-config-prettier"]
phying_url: "https://phying.com/item/6703"
lang: en
---

# Still Trusting Automated Patches Blindly? Think Again

## Summary

How a phishing breach of the eslint-config-prettier maintainer's npm account shipped six malicious versions and three more infected packages (~78M weekly downloads) with a Windows malware payload.

## Intelligence Metadata

- **Sources:** jfrog.com
- **Published:** 2025-07-23T13:08:52Z
- **Original:** https://jfrog.com/blog/npm-automated-patching-breach/
- **Phying News:** https://phying.com/item/6703