#nodepackagemanager — Public Fediverse posts

Malicious npm packages exploit runtime evasion tactics

Meet the sneaky npm package that impersonated a popular library, racking up 2 million weekly downloads before revealing its true malicious intent. This cleverly disguised package, indexed-btree, hid its payload in plain sight, masquerading as a legitimate tool until it was too late.

https://osintsights.com/malicious-npm-packages-exploit-runtime-evasion-tactics?utm_source=mastodon&utm_medium=social

#SupplyChain #MaliciousPackages #RuntimeEvasion #Npm #NodePackageManager

North Korea-linked actor compromises axios NPM package

A shocking discovery by Google Threat Intelligence Group has exposed a vulnerability in the popular axios NPM package, which has over 100 million weekly downloads, and has raised urgent questions about the trustworthiness of software supply chains. A malicious dependency was secretly introduced into axios releases, putting countless…

https://osintsights.com/north-korea-linked-actor-compromises-axios-npm-package

#Axios #Npm #NodePackageManager #NorthKorea #GoogleThreatIntelligenceGroup

Neuer #npm-Großangriff: Hunderte Pakete mit selbst-vermehrender #Malware infiziert | Security https://www.heise.de/news/Neuer-NPM-Grossangriff-Selbst-vermehrende-Malware-infiziert-Dutzende-Pakete-10651111.html #NodeJS #worm #NodePackageManager

Always fun when npm’s publish authentication route 404s.

#NodePackageManager #npm #npmjs #js #node