Security News > 2020 > October > NPM nukes NodeJS malware opening Windows, Linux reverse shells
These 4 packages had collected over 1,000 total downloads over the course of the last few months up until being removed by NPM yesterday.
Although the malicious packages were spotted and removed by NPM, I was able to dig into Sonatype's automated malware detection system archives to obtain copies of their source code, as it had existed on NPM downloads.
After the packages are installed, the code establishes a reverse shell to the attacker's server, allowing the attacker to obtain remote access to the compromised machine.
Json was faked by the malware author, or the malware author published these malicious packages using compromised GitHub and npm accounts belonging to different developers.
As observed by BleepingComputer, the different NPM author accounts associated with these 4 packages have now been shut down by npm.
News URL
Related news
- New CRON#TRAP Malware Infects Windows by Hiding in Linux VM to Evade Antivirus (source)
- BeaverTail Malware Resurfaces in Malicious npm Packages Targeting Developers (source)
- Russia targets Ukrainian conscripts with Windows, Android malware (source)
- Windows infected with backdoored Linux VMs in new phishing attacks (source)
- Malware Campaign Uses Ethereum Smart Contracts to Control npm Typosquat Packages (source)
- New SteelFox malware hijacks Windows PCs using vulnerable driver (source)
- Malicious NPM Packages Target Roblox Users with Data-Stealing Malware (source)
- Chinese hackers target Linux with new WolfsBane malware (source)
- Researchers discover first UEFI bootkit malware for Linux (source)
- BootKitty UEFI malware exploits LogoFAIL to infect Linux systems (source)