Fake WhatsApp developer libraries hide destructive data-wiping code
It has been found that two malicious NPM packages masquerading as WhatsApp development tools use destructive data-wiping malware to recursively remove files from developers' machines.
There are now two malicious NPM packages in the registry that use harmful data-wiping malware to target WhatsApp developers. Since their release last month, the packages—which were uncovered by Socket researchers—have been downloaded more than 1,100 times. They pose as WhatsApp socket libraries.
At the time of writing, both are still accessible even though Socket had flagged the publisher, Nayflore, and sent takedown requests. Although the same publisher has submitted other packages to NPM, including nouku-search, very-nay, naya-clone, node-smsk, and @veryflore/disc, the two malicious packages are call...