Not pretty, not Windows-only: npm phishing attack laces popular packages with malware

The popular npm package "is" was infected with cross-platform malware, around the same time that linting utility packages used with the prettier code formatter were infected with Windows-only malware. This was likely caused by a phishing attack using a typosquatted clone of the official npm site. The "is" package is used for JavaScript type testing and is downloaded around 2.7 million times a week. Version 3.3.1 includes an obfuscated JavaScript malware loader, as reported by the team at Socket, which provides a security platform for developers. The malware captures data including all environment variables (often a source of secrets such as credentials), exfiltrates them via a WebSocket connection, and provides the attacker with an interactive remote shell. The malware runs on Node.js on macOS, Linux and Windows, and persists itself if possible by overwriting an index.js file so that even deleting the node_modules directory, which stores downloaded packages, will not remove it. Maintainer Jordan Harband reported the problem last weekend, stating that it was "due to another maintainer's account being hijacked." According to a thread on Bluesky Harband himself was deceived by an email from a former package owner who had been removed and asked to be re-added. "Everything seemed normal, so I obliged (irritated that npm would remove an owner without notifying the other owners) and the next morning this was published," he said. Socket also found malicious releases of the got-fetch ...