TLDR Tech / InfoSec
Malicious npm Package react-refresh-update Drops Cross-Platform Trojan on Developer Machines
SafeDep has identified 'react-refresh-update,' a typosquatting npm package mimicking Meta's 'react-refresh.' This malicious package injects a two-layer XOR-obfuscated dropper into 'runtime.js,' executing silently upon 'require()' with no install hooks. The C2 domain 'malicanbur[.]pro' and secondary IP '173.211.46[.]22:8080' have been attributed to Lazarus Group's 'DeceptiveDevelopment' campaign, with the second-stage binary classified as PylangGhost RAT. The payload is OS-aware: on Windows, it fetches a 28.71 MB self-extracting archive via chunked axios range requests and executes 'start.vbs' via a hidden wscript process. On Linux and macOS, it downloads and executes '/var/tmp/macspatch.sh' with TLS verification disabled. The encrypted-in-memory 'eval()' execution pattern bypasses static analysis tools, marking this as a significant escalation in AI coding agent supply chain targeting, where inflated version numbers and mirrored codebases can evade automated package selection.
Read the full story