The story of the compromise of 18 NPM packages, totaling over 2 billion downloads per week, has continued. A similar takeover was identified through phishing credentials of an NPM package maintainer for the DuckDB project. Malicious versions were also created for DuckDB packages, containing code that substitutes payment credentials during cryptocurrency transactions, but the attack was quickly detected, resulting in only a few downloads of the malicious packages. Preliminary data shows that the packages with malicious inserts published during yesterday's announced attack on 18 NPM packages were downloaded over 2.5 million times.
Packages compromised in the second phishing attack:
Source: opennet.ru
