{"id":139659,"date":"2025-07-21T11:12:05","date_gmt":"2025-07-21T09:12:05","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami"},"modified":"2025-07-21T11:12:05","modified_gmt":"2025-07-21T09:12:05","slug":"fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/fishing-pozvolil-poluchit-kontrol-nad-neskolkimi-populyarnymi-npm-paketami","title":{"rendered":"Phishing has allowed control over several popular NPM packages.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
A phishing attack has been reported against JavaScript library maintainers, during which a message was sent on behalf of the NPM service, notifying users to confirm their email. The attack allowed attackers to obtain NPM tokens from the maintainer of one of the major JavaScript projects and release updates with malicious code for five NPM packages, totaling around 100 million downloads per week. <\/p>\n
The message sent by the sender was styled to resemble standard notifications from NPM, sent from the address 'support@npmjs.org', but the link provided pointed to the domain 'npnjs.com' instead of 'npmjs.com' (the third letter being 'n' instead of 'm'). The attackers exploited a psychological effect, where the brain, anticipating the expected outcome, overlooks minor distortions, such as substituting similar letters or rearranging the order of letters in a word. Clicking the link opened a complete replica of the npmjs.com site (likely a proxy was set up to intercept the access token).
<\/center> <\/p>\n
During the attack, new package versions were created: <\/p>\n
Malicious code was added to the created releases to attack users utilizing the Windows platform. The changes made loaded the library node-gyp.dll, which contained functionality for remote command execution on the system. <\/p>\n
The maintainer noticed that he had fallen victim to phishing about an hour after the first complaint was received regarding the publication of suspicious releases. He immediately revoked the access token, changed passwords, marked the problematic versions as deprecated to prevent downloads by automated build systems, and submitted a request to remove the problematic versions from the repository to NPM support. <\/p>\n
It is not specified how many users managed to download the malicious versions (for instance, the malicious version of the package eslint-plugin-prettier remained in the repository for about two days). Last week, the package eslint-config-prettier had 30 million downloads and was used as a dependency in 11,762 packages, the package eslint-plugin-prettier had 21 million downloads (8,468 dependent packages), synckit had 18 million, @pkgr\/core had 16 million, and napi-postinstall had 10 million. \n Source: opennet.ru<\/a> <\/p>","protected":false,"gt_translate_keys":[{"key":"rendered","format":"html"}]},"excerpt":{"rendered":"
![\"Phishing](\"\/wp-content\/uploads\/2025\/07\/0d5e2613f7265b3fcca6ee367c0ecac9.png\")
<\/center> <\/p>\n