Security News > 2020 > October > NPM nukes NodeJS malware opening Windows, Linux reverse shells

NPM nukes NodeJS malware opening Windows, Linux reverse shells
2020-10-16 11:44

These 4 packages had collected over 1,000 total downloads over the course of the last few months up until being removed by NPM yesterday.

Although the malicious packages were spotted and removed by NPM, I was able to dig into Sonatype's automated malware detection system archives to obtain copies of their source code, as it had existed on NPM downloads.

After the packages are installed, the code establishes a reverse shell to the attacker's server, allowing the attacker to obtain remote access to the compromised machine.

Json was faked by the malware author, or the malware author published these malicious packages using compromised GitHub and npm accounts belonging to different developers.

As observed by BleepingComputer, the different NPM author accounts associated with these 4 packages have now been shut down by npm.


News URL

https://www.bleepingcomputer.com/news/security/npm-nukes-nodejs-malware-opening-windows-linux-reverse-shells/

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Linux 11 64 2532 1569 67 4232
Nodejs 2 3 50 88 14 155