Cybersecurity researchers have discovered malicious npm packages that are exfiltrating sensitive data.
Cybersecurity researchers have recently detected a new group of malicious packages in the npm package registry that have been designed to extract sensitive developer information. Phylum, a software supply chain firm, was the first to identify these "test" packages on July 31, 2023. Shortly after their discovery, the packages were removed and re-uploaded under different names that appeared legitimate. The motive behind this campaign remains unclear, but it is suspected to be targeted at the cryptocurrency sector due to references to modules like "rocketrefer" and "binarium." All the packages were published by a user named malikrukd4732. Each module shares a common feature: the ability to execute JavaScript ("index.js") code, which can then exfiltrate valuable information to a remote server. This code is spawned in a child process by the "preinstall.js" file, which is executed upon package installation, initiating the execution of all the...