Hundreds of code libraries posted to NPM try to install malware on dev machines

Quick Summary:

The discovery comes on the heels of a similar campaign a few weeks ago targeting developers using forks of the Ethers.js library.“Out of necessity, malware authors have had to endeavor to find more novel ways to hide intent and to obfuscate remote servers under their control,” Phylum researchers wrote.“This is, once again, a persistent reminder that supply chain attacks are alive and well.

The campaign, which was active at the time this post was going live on Ars, was reported by researchers from the security firm Phylum.

The malicious packages have names that are similar to legitimate ones for the Puppeteer and Bignum.js code libraries and for various libraries for working with cryptocurrency.

---

More Pictures

---

Read Quick SummarySave Time

or

Article Details

Author / Journalist: Dan Goodin

Category: Technology

Markets: United StatesMali

Topics: Malware Code libraries Security Typosquatting

Source Website Secure: Yes (HTTPS)

News Sentiment: Negative

Fact Checked: Legitimate

Article Type: News Report

Published On: 2024-11-04 @ 23:28:49 (2 weeks ago)

News Timezone: GMT -5:00

News Source URL: arstechnica.com

Language: English

Article Length: 153 words

Reading Time: 1 minutes read

Sentences: 39 lines

Sentence Length: 4 words per sentence (average)

Platforms: Desktop Web, Mobile Web, iOS App, Android App

Copyright Owner: © Ars Technica

News ID: 23417636

View Article Analysis

About Ars Technica

Main Topics: Technology

Official Website: arstechnica.com

Update Frequency: 4 posts per day

Year Established: 1998

Headquarters: United States

News Last Updated: 10 hours ago

Coverage Areas: United States

Ownership: Independent Company

Publication Timezone: GMT -5:00

Content Availability: Worldwide

News Language: English

RSS Feed: Available (XML)

API Access: Available (JSON, REST)

Website Security: Secure (HTTPS)

Publisher ID: #32

Publisher Details

Frequently Asked Questions