Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer

What’s new: Nearly 800 malicious npm packages have been identified, designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. These packages utilize AI-generated typo-squatting names and instruct developers to load them using the require() function, leading to the execution of a downloader named WEL1DROPPER. This downloader fetches payloads from various domains, including Cloudflare Workers and a domain associated with Russian financial institutions. The malware includes capabilities for establishing persistence and evading detection.

Who’s affected

Developers and organizations using npm packages, particularly those that may inadvertently install these malicious packages, are at risk. The malware targets multiple operating systems, including Windows, macOS, and Linux.

What to do

• Review and audit npm package dependencies regularly to identify any potentially malicious packages.
• Implement security measures such as package signing and integrity checks to prevent the installation of compromised packages.
• Educate developers about the risks of using unverified packages and the importance of scrutinizing package sources.
• Monitor network traffic for unusual activity that may indicate the presence of malware.

Sources

• The Hacker News