{"id":106945,"date":"2023-02-26T12:49:02","date_gmt":"2023-02-26T10:49:03","guid":{"rendered":"https:\/\/prohoster.info\/?p=106945"},"modified":"2023-02-27T12:02:06","modified_gmt":"2023-02-27T10:02:06","slug":"v-npm-vyyavleno-15-tysyach-paketov-dlya-fishinga-i-spama","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/v-npm-vyyavleno-15-tysyach-paketov-dlya-fishinga-i-spama","title":{"rendered":"NPM has identified 15,000 packages for phishing and spam.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
An attack on users of the NPM directory has been recorded, resulting in over 15,000 packages being posted to the NPM repository on February 20, with README files containing links to phishing sites or referral links that offer commissions for clicks. Analysis revealed 190 unique phishing or advertising links covering 31 domains within the packages. <\/p>\n
Package names were chosen to attract the interest of the general public, such as «free-tiktok-followers», «free-xbox-codes», «instagram-followers-free», etc. The idea was to fill the recent updates list on the NPM homepage with spammy packages. The package descriptions included links promising free giveaways, gifts, game cheats, as well as free services to boost followers and likes on social networks like TikTok and Instagram. This is not the first such attack; in December, 144,000 spam packages were published in the NuGet, NPM, and PyPi directories.
<\/center> <\/p>\n
The content of the packages was generated automatically using a Python script that, apparently due to oversight, was left in the packages and included working credentials used during the attack. The packages were published under numerous different accounts using methods that complicated the tracing of the source and the quick identification of problematic packages. <\/p>\n
In addition to fraudulent activities, several attempts to publish malicious packages have also been detected in the NPM and PyPi repositories: <\/p>\n
\n
The PyPI repository has found 451 malicious packages that disguised themselves as popular libraries using typosquatting (assigning similar names differing by individual characters, e.g., vper instead of vyper, bitcoinnlib instead of bitcoinlib, ccryptofeed instead of cryptofeed, ccxtt instead of ccxt, cryptocommpare instead of cryptocompare, seleium instead of selenium, pinstaller instead of pyinstaller, etc.). The packages included obfuscated code for stealing cryptocurrency, which identified the presence of cryptocurrency wallet IDs in the clipboard and replaced them with the attacker\u2019s wallet (it is assumed that the victim would not notice that the wallet number being transferred through the clipboard was different when making a payment). The replacement was carried out by a browser extension embedded in the context of each viewed web page.\n
A series of malicious HTTP libraries have been identified in the PyPI repository. Malicious activity was found in 41 packages, whose names were chosen using typosquatting methods and resembled popular libraries (aio5, requestst, ulrlib, urllb, libhttps, piphttps, httpxv2, etc.). The content was styled to look like working HTTP libraries or copied the code of existing libraries, and the description included claims of advantages and comparisons with legitimate HTTP libraries. The malicious activity was either aimed at downloading malware to the system or collecting and sending confidential data.\n
16 JavaScript packages (speedte*, trova*, lagra) have been identified in NPM that, in addition to their declared functionality (bandwidth testing), also contained code for mining cryptocurrency without the user\u2019s knowledge.\n
![\"NPM](\"\/wp-content\/uploads\/2023\/02\/434214f596ba6d4174a3f0a8eae982e4.jpg\")
<\/center> <\/p>\n