800+ Malicious npm Packages Deliver Cross‑Platform RAT and Infostealer
A wave of nearly 800 malicious npm packages has been discovered, delivering a cross‑platform Remote Access Trojan and infostealer to Windows, macOS, and Linux.
A recent wave of malicious npm packages has been identified, numbering nearly 800, which aim to deliver a cross‑platform Remote Access Trojan (RAT) and an infostealer to Windows, macOS, and Linux systems.
The packages are hosted in the official npm registry, making them appear legitimate to developers who install them via npm install.
Each package contains a small bootstrap script that, once executed, downloads and runs a binary compiled for the target operating system.
The binaries are obfuscated and use native code, allowing the malware to bypass many static analysis tools.
The campaign’s authors appear to have employed a form of typo‑squatting, generating package names that resemble legitimate packages but contain subtle misspellings or AI‑generated slop.
OpenSourceMalware researcher Paul observed that the names are often random and do not follow any clear pattern beyond the misspelling.
In a public statement, Paul said the payload is a powerful RAT that can exfiltrate credentials, keystrokes, and system information, and also contains an infostealer module that harvests passwords and tokens from browsers and local files.
Because the packages are distributed through npm, developers who install them without scrutinizing the package metadata may unwittingly introduce the malware into their projects.
Security teams should monitor npm audit logs for unusual package installations and use tools such as npm audit or npm-check to verify the integrity of dependencies.
The incident underscores the importance of source verification and the need for the npm ecosystem to enforce stricter naming policies and automated checks against typo‑squatting.
Developers are advised to review the dependencies in their package.json files, remove unused or suspicious packages, and rely on reputable sources for third‑party modules.
The cross‑platform nature of the RAT means that a single malicious dependency can compromise an entire development team’s infrastructure, regardless of the operating system used.
OpenSourceMalware continues to monitor the npm registry for new malicious packages and will update the community on any further developments.
In the meantime, the npm community and maintainers should collaborate to improve package vetting processes and to provide better tooling for dependency hygiene.
800+ Malicious npm Packages Deliver Cross‑Platform RAT and Infostealer
A recent wave of malicious npm packages has been identified, numbering n…
A recent wave of malicious npm packages has been identified, numbering nearly 800, which aim to deliver a cross‑platform Remote Access Trojan (RAT) and an infostealer to Windows, macOS, and Linux systems.
The packages are hosted in the official npm registry, making them appear legitimate to developers who install them via npm install.
Each package contains a small bootstrap script that, once executed, down…
Each package contains a small bootstrap script that, once executed, downloads and runs a binary compiled for the target operating system.
The binaries are obfuscated and use native code, allowing the malware to bypass many static analysis tools.
The campaign’s authors appear to have employed a form of typo‑squatting,…
The campaign’s authors appear to have employed a form of typo‑squatting, generating package names that resemble legitimate packages but contain subtle misspellings or AI‑generated slop.
OpenSourceMalware researcher Paul observed that the names are often random and do not follow any clear pattern beyond the misspelling.
In a public statement, Paul said the payload is a powerful RAT that can…
In a public statement, Paul said the payload is a powerful RAT that can exfiltrate credentials, keystrokes, and system information, and also contains an infostealer module that harvests passwords and tokens from browsers and local files.
Because the packages are distributed through npm, developers who install them without scrutinizing the package metadata may unwittingly introduce the malware into their projects.
Security teams should monitor npm audit logs for unusual package install…
Security teams should monitor npm audit logs for unusual package installations and use tools such as npm audit or npm-check to verify the integrity of dependencies.
The incident underscores the importance of source verification and the need for the npm ecosystem to enforce stricter naming policies and automated checks against typo‑squatting.
Developers are advised to review the dependencies in their package.json…
Developers are advised to review the dependencies in their package.json files, remove unused or suspicious packages, and rely on reputable sources for third‑party modules.
The cross‑platform nature of the RAT means that a single malicious dependency can compromise an entire development team’s infrastructure, regardless of the operating system used.
Continued (2)
OpenSourceMalware continues to monitor the npm registry for new maliciou…
OpenSourceMalware continues to monitor the npm registry for new malicious packages and will update the community on any further developments.
In the meantime, the npm community and maintainers should collaborate to improve package vetting processes and to provide better tooling for dependency hygiene.