TLDR Tech / InfoSec
Fake install logs in npm packages load RAT
Researchers found a cluster of malicious npm packages, dubbed the "Ghost campaign," that has been active since early February. Published by a single npm user, the packages display fake installation logs with random delays and a progress bar to disguise malicious activity. During this fake process, users are prompted to enter their sudo password under the guise of fixing installation errors. That password is then used to execute a final-stage RAT that steals crypto wallets and sensitive data. Other research links a related package to the same techniques, suggesting this may have been an early test run of a broader campaign.
Read the full story