Four packages in the NPM repository were found to be transmitting user data.
Malicious activity has been detected in four packages in the NPM repository, which included a preinstall script that sent information about the IP address, location, username, CPU model, and home directory of the user to GitHub before package installation. The malicious code was found in the packages electorn (255 downloads), lodashs (78 downloads), loadyaml (48 downloads), and loadyml (37 downloads). The problematic packages were hosted in […
