Cybersecurity researchers have uncovered two hijacked npm packages and a cluster of Go packages that are designed to deploy a Python-based information stealer on compromised Windows, Linux, and macOS hosts.
"This attack avoids the most common npm execution paths through lifecycle scripts, perhaps in an attempt to remain 'compatible' with npm v12's security hardenings," JFrog said in a
_811205.png)
_e196d8.png)
_32b3d9.png)
_1c53fe.png)
Recommended Comments
Join the conversation
You can post now and register later. If you have an account, sign in now to post with your account.