Security News > 2020 > October > NPM nukes NodeJS malware opening Windows, Linux reverse shells
These 4 packages had collected over 1,000 total downloads over the course of the last few months up until being removed by NPM yesterday.
Although the malicious packages were spotted and removed by NPM, I was able to dig into Sonatype's automated malware detection system archives to obtain copies of their source code, as it had existed on NPM downloads.
After the packages are installed, the code establishes a reverse shell to the attacker's server, allowing the attacker to obtain remote access to the compromised machine.
Json was faked by the malware author, or the malware author published these malicious packages using compromised GitHub and npm accounts belonging to different developers.
As observed by BleepingComputer, the different NPM author accounts associated with these 4 packages have now been shut down by npm.
News URL
Related news
- Suspected Russian Data-Wiping 'AcidPour' Malware Targeting Linux x86 Devices (source)
- Windows 11, Tesla, and Ubuntu Linux hacked at Pwn2Own Vancouver (source)
- DinodasRAT malware targets Linux servers in espionage campaign (source)
- Detecting Windows-based Malware Through Better Visibility (source)
- Microsoft fixes two Windows zero-days exploited in malware attacks (source)
- Russia's APT28 Exploited Windows Print Spooler Flaw to Deploy 'GooseEgg' Malware (source)
- Bogus npm Packages Used to Trick Software Developers into Installing Malware (source)