Since at least December 2021, the NPM package manager has been the victim of a broad software supply chain attack that used rogue modules to collect information from forms that users filled out on websites that used them.
Twenty-one NPM packages that contain obfuscated JavaScript, together with malicious code, are used in the coordinated attack, nicknamed IconBurst by ReversingLabs, to gather sensitive information from forms placed in websites and mobile applications that are later on.
The aforementioned packages, majority of which were very recently released, have been downloaded more than 27,000 times altogether as of the report. Furthermore, most of the modules are still accessible for download from the repository.
Read More: https://thehackernews.com/2022/07/researchers-uncover-malicious-npm.html?m=1
For more such updates follow us on Google News ITsecuritywire News
