Fake install logs in npm packages load RAT
The final-stage malware in the Ghost campaign is a RAT designed to steal crypto wallets and sensitive data.
Lucija Valentić
Software Threat Researcher, ReversingLabs. Lucija works on the TitaniumCore Team.
Posts from Lucija Valentić
Fake install logs in npm packages load RAT
Inside the fake crypto developer recruitment hack
Here’s a more-in-depth technical analysis of the packages involved in the "graphalgo" campaign.
Ethereum contracts push malware on npm
RL discovered how the crypto contracts were abused — and how this incident is tied to a larger campaign to promote malicious packages on top repositories.
Threat actors claim VS Code extension names
RL has discovered a loophole on VS Code Marketplace that allows threat actors to reuse legitimate, removed package names for malicious purposes.
Atomic and Exodus crypto wallets targeted in malicious npm campaign
RL researchers have identified yet another npm package that uses malicious patching of local software to hijack cryptocurrency transfers.
Malware found on npm infecting local package with reverse shell
For the first time, RL researchers discover malicious locally-installed npm packages infecting other legitimate packages.
A new playground: Malicious campaigns proliferate from VSCode to npm
To avoid compromised packages being introduced as a dependency in a larger project, security teams need to keep an eye peeled for such malicious code.
Differential analysis raises red flags over @lottiefiles/lottie-player
Three versions of the popular package were infected and used to spread malicious code that was stealing crypto wallet assets.
Malicious npm package targets AWS users
The history of the package is a lesson in why tracking open source threats is such a challenge — and highlights the value of RL's new Spectra Assure Community.