Tag: Hijacked npm

Two hacked npm packages and a group of Go packages that are intended to install a Python-based information stealer on vulnerable Windows, Linux, and macOS hosts have been discovered by cybersecurity researchers. According to JFrog's technical research, this assault uses lifecycle scripts to avoid the most popular npm execution paths, possibly in an effort to stay "compatible" with npm v12's security hardenings. The package is set up to start automatically when the project folder is opened in Visual Studio Code, concealing execution within a task. The malware then connects to attacker-controlled infrastructure, runs a socket.io backdoor, extracts encrypted JavaScript from blockchain transaction data, and finally installs a Python infostealer The names of the identified npm package...