Dozens of malicious packages on NPM collect host and network data

60 packages have been discovered in the NPM index that attempt to collect sensitive host and network data and send it to a Discord webhook controlled by the threat actor. According to Socket’s Threat Research team, the packages were uploaded to the NPM repository starting May 12 from three publisher accounts. Each of the malicious packages contains a post-install script that automatically executes during ‘npm install’ and collects the following information: The script checks for hostnames related to cloud providers, reverse DNS strings, in an attempt to determine if it is running in an analysis environment. Socket did not observe the delivery of second-stage payloads, privilege escalation, or any persistent mechanisms. However, given the type of data collected, the danger of targeted network attacks is significant. The researchers reported the malicious packages but at the time of writing they were still available on NPM and showed a cumulative download count of 3,000. By publishing time, though, none of them were present in the repository. To trick developers into using them, the threat actor behind the campaign used names similar to legitimate packages in the index, like ‘flipper-plugins,’ ‘react-xterm2,’ and ‘hermes-inspector-msggen,’ generic trust-evoking names, and others that hint at testing, possibly targeting CI/CD pipelines. The complete list of the 60 malicious packages is available at the bottom section of Socket’s report. If you have installed any of them, it is ...