A trojanized npm package is a Node.js dependency that still appears legitimate and useful, but has been modified to include malicious code. The harmful logic may run during install, import, or postinstall steps, so developers can pull it in as if it were a normal utility.
This matters because npm is widely trusted in build pipelines and application code. A poisoned package can steal secrets, modify software, or drop an implant that turns a host into a proxy, relay, or foothold for deeper access. Defenders look for unusual package provenance, unexpected install-time behavior, risky transitive dependencies, and network patterns such as unexpected SOCKS5 or forwarding activity. Lockfiles, allowlists, code review, and dependency scanning help reduce the chance that a useful-looking library becomes a supply-chain attack vector.