Summary
On June 2, 2026 Sentry was informed by a customer that they received an error message in a Sentry project they didn’t expect. Sentry immediately initiated our Incident Response process and began investigating the source of the issue.
The crafted events were designed as AI prompts to convince agents to install a third party NPM package. When installed, these packages would collect telemetry from the endpoint that installed it, fingerprinting the device.
These messages referred to three NPM packages typo-squatting similar Sentry package names, none of which are owned or maintained by Sentry. These packages were published on June 1, 2026 and later updated on June 2, 2026:
@node-diagnostics/profiler@sdk-utils/sentry-profiler@sentry-browser-sdk/profiling-node@sentry-internals/profiling-node
The most recent versions of these packages are malicious, a sample of the source code can be found in the References section. If installed, these packages would exfiltrate sensitive data from endpoints, specifically:
- Harvests credentials - dumps your entire process.env (all API keys, tokens, secrets), checks for
~/.npmrc, ~/.aws/config, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.config/gh/hosts.yml
- Targets AI IDEs specifically -
getRuntime() fingerprints CLAUDE_CODE, ANTHROPIC_API_KEY, CURSOR_SESSION_ID, GITHUB_COPILOT, CODEIUM_API_KEY, etc. This was built to run in AI coding environments.
Sentry immediately reported these packages to NPM requesting they be removed on June 2, 2026. We then also shared these details as threat intelligence with several industry partners. NPM confirmed the removal of these packages no later than June 3, 2026 at 12:09 UTC.
Am I impacted?
All potentially affected Sentry customers have been notified. If you have not been contacted directly, you are not impacted.
This is not a vulnerability within Sentry and there has been no compromise of Sentry infrastructure.
Indicators of Compromise
NPM Packages:
@node-diagnostics/profiler
@sdk-utils/sentry-profiler
@sentry-browser-sdk/profiling-node
@sentry-internals/profiling-node
Commands seen in the crafted events:
npx {package-name} --diagnose
Network:
advisory-tracker[.]com
https://advisory-tracker[.]com/api/v1/telemetry
52.206.47[.]180
Other signatures:
profiling-node/1.0.0 (User-Agent)
X-Tenet-Security: ResponsibleDisclosure [SECURITY SCAN] (request header)
NPM has removed the packages, so the source is no longer available through normal means. A preserved sample of the malicious package source is in this gist.
Workarounds
For hardening of your Sentry project, we recommend the use of Inbound Filters and particularly IP Address filters.
References
As NPM has removed these packages, the source is no longer available through usual means. Please see the following gist as reference:
Credit
Thank you to Serana Warren and Matej Bukovinski at Nutrient.io. Sentry can confirm the activity documented in their blog post and GitHub repo is accurate.
neonspectra Analyst
Summary
On June 2, 2026 Sentry was informed by a customer that they received an error message in a Sentry project they didn’t expect. Sentry immediately initiated our Incident Response process and began investigating the source of the issue.
The crafted events were designed as AI prompts to convince agents to install a third party NPM package. When installed, these packages would collect telemetry from the endpoint that installed it, fingerprinting the device.
These messages referred to three NPM packages typo-squatting similar Sentry package names, none of which are owned or maintained by Sentry. These packages were published on June 1, 2026 and later updated on June 2, 2026:
@node-diagnostics/profiler@sdk-utils/sentry-profiler@sentry-browser-sdk/profiling-node@sentry-internals/profiling-nodeThe most recent versions of these packages are malicious, a sample of the source code can be found in the References section. If installed, these packages would exfiltrate sensitive data from endpoints, specifically:
~/.npmrc, ~/.aws/config, ~/.kube/config, ~/.docker/config.json, ~/.netrc, ~/.config/gh/hosts.ymlgetRuntime()fingerprintsCLAUDE_CODE, ANTHROPIC_API_KEY, CURSOR_SESSION_ID, GITHUB_COPILOT, CODEIUM_API_KEY, etc. This was built to run in AI coding environments.Sentry immediately reported these packages to NPM requesting they be removed on June 2, 2026. We then also shared these details as threat intelligence with several industry partners. NPM confirmed the removal of these packages no later than June 3, 2026 at 12:09 UTC.
Am I impacted?
All potentially affected Sentry customers have been notified. If you have not been contacted directly, you are not impacted.
This is not a vulnerability within Sentry and there has been no compromise of Sentry infrastructure.
Indicators of Compromise
NPM Packages:
Commands seen in the crafted events:
Network:
Other signatures:
NPM has removed the packages, so the source is no longer available through normal means. A preserved sample of the malicious package source is in this gist.
Workarounds
For hardening of your Sentry project, we recommend the use of Inbound Filters and particularly IP Address filters.
References
As NPM has removed these packages, the source is no longer available through usual means. Please see the following gist as reference:
Credit
Thank you to Serana Warren and Matej Bukovinski at Nutrient.io. Sentry can confirm the activity documented in their blog post and GitHub repo is accurate.