Malware Found Concealed in npm Yet Again
The Node Package Manager (npm) is a popular platform for developers to share and reuse code. However, it has been plagued by security issues in recent years. Once again, malware has been found concealed in npm packages.
The malware was discovered by Sonatype, a software supply chain management company. They found that a package called “electorn” contained malicious code that could steal sensitive information from users. The package had been downloaded over 1,200 times before it was removed from the npm registry.
The malware was designed to target Windows users and was disguised as a legitimate package for the Electron framework. The package contained a script that would download and execute a remote file, which would then steal sensitive information such as passwords and credit card numbers.
This is not the first time that malware has been found in npm packages. In 2018, a package called “event-stream” was found to contain malicious code that could steal Bitcoin wallets. The package had been downloaded over 8 million times before it was removed from the npm registry.
The problem with npm is that it is easy for developers to include third-party packages in their code without thoroughly vetting them. This makes it easy for attackers to slip in malicious code undetected. In addition, many developers do not update their packages regularly, leaving them vulnerable to known security issues.
To protect themselves from these types of attacks, developers should always vet third-party packages before including them in their code. They should also keep their packages up-to-date and monitor for any security issues that may arise.
In addition, users should be cautious when downloading software from unknown sources. They should always verify the authenticity of the software and only download from trusted sources.
Overall, the discovery of malware in npm packages highlights the importance of software supply chain security. Developers and users alike must take steps to protect themselves from these types of attacks. By being vigilant and proactive, we can help prevent these types of security breaches from occurring in the future.
- SEO Powered Content & PR Distribution. Get Amplified Today.
- Minting the Future w Adryenn Ashley. Access Here.
- Buy and Sell Shares in PRE-IPO Companies with PREIPO®. Access Here.
- PlatoAiStream. Web3 Data Intelligence. Knowledge Amplified. Access Here.
- Source: https://zephyrnet.com/once-again-malware-discovered-hidden-in-npm/