Popular npm linter packages hijacked via phishing to drop malware

Popular npm linter packages hijacked via phishing to drop malware

This article discusses a recent supply chain attack on popular JavaScript libraries through targeted phishing and credential theft, leading to malware deployment. Developers are advised to verify affected package versions and monitor their environments for signs of compromise. #npm #supplychainattack

Keypoints

  • A supply chain attack compromised popular npm packages like eslint-config-prettier and eslint-plugin-prettier.
  • The attacker used stolen credentials obtained through phishing to publish malicious package versions.
  • The malicious packages contained a postinstall script that executed a dangerous DLL on Windows machines.
  • Developers are urged to avoid installing affected versions and verify lock files for compromised dependencies.
  • The incident underscores the importance of maintainer security and vigilance in open-source ecosystems.

Read More: https://www.bleepingcomputer.com/news/security/popular-npm-linter-packages-hijacked-via-phishing-to-drop-malware/