Security News > 2020 > October > NPM nukes NodeJS malware opening Windows, Linux reverse shells
These 4 packages had collected over 1,000 total downloads over the course of the last few months up until being removed by NPM yesterday.
Although the malicious packages were spotted and removed by NPM, I was able to dig into Sonatype's automated malware detection system archives to obtain copies of their source code, as it had existed on NPM downloads.
After the packages are installed, the code establishes a reverse shell to the attacker's server, allowing the attacker to obtain remote access to the compromised machine.
Json was faked by the malware author, or the malware author published these malicious packages using compromised GitHub and npm accounts belonging to different developers.
As observed by BleepingComputer, the different NPM author accounts associated with these 4 packages have now been shut down by npm.
News URL
Related news
- Researchers discover first UEFI bootkit malware for Linux (source)
- BootKitty UEFI malware exploits LogoFAIL to infect Linux systems (source)
- Windows, macOS users targeted with crypto-and-info-stealing malware (source)
- New Malware Technique Could Exploit Windows UI Framework to Evade EDR Tools (source)
- New stealthy Pumakit Linux rootkit malware spotted in the wild (source)
- Iran-Linked IOCONTROL Malware Targets SCADA and Linux-Based IoT Platforms (source)
- Rspack npm Packages Compromised with Crypto Mining Malware in Supply Chain Attack (source)
- FBI wipes Chinese PlugX malware from thousands of Windows PCs in America (source)