Infostealer campaign compromises 10 npm packages, targets devs

Ten npm packages were suddenly updated with malicious code yesterday to steal environment variables and other sensitive data from developers' systems. The campaign targeted multiple cryptocurrency-related packages, and the popular 'country-currency-map' package was downloaded thousands of times a week. The malicious code was discovered by Sonatype researcher Ali ElShakankiry and is found in two heavily obfuscated scripts, "/scripts/launch.js" and "/scripts/diagnostic-report.js," which execute upon the package installation. Sonatype says that the JavaScript steals the device's environment variables and sends them to the remote host "eoi2ectd5a5tn1h.m.pipedream(.)net)". Environment variables are commonly targeted as they can contain API keys, database credentials, cloud credentials, and encryption keys, which can be used for further attacks. As Sonatype malware analyst and fellow BleepingComputer reporter Ax Sharma explains in a write-up, as the malicious code is the same in all of the repositories and most have had a clean record for years, they were likely compromised in some manner. "We hypothesize the cause of the hijack to be old npm maintainer accounts getting compromised either via credential stuffing (which is where threat actors retry usernames and passwords leaked in previous breaches to compromise accounts on other websites), or an expired domain takeover — both common scenarios explained in npm documentation," reports Sonatype. "Given the concurrent timing of the a...