Crypto-miner found hidden inside three npm libraries

guest · Oct 21, 2021

Crypto-miner found hidden inside three npm libraries
October 20, 2021
https://therecord.media/crypto-miner-found-hidden-inside-three-npm-libraries/

DevOps security firm Sonatype has uncovered crypto-mining malware hidden inside three JavaScript libraries uploaded on the official npm package repository.

The three files, disguised as user-agent string parsers, would detect the user’s operating system and then run a BAT or Shell script, based on the victim’s platform.

“These scripts then download an externally-hosted EXE or a Linux ELF, and execute the binary with arguments specifying the mining pool to use, the wallet to mine cryptocurrency for, and the number of CPU threads to utilize,” said Sonatype security researcher Ali ElShakankiry, who discovered the campaign.
Click to expand...

This campaign’s specifics include: [...]
Click to expand...

guest · Oct 23, 2021

Malware Discovered in Popular NPM Package, ua-parser-js
October 22, 2021
https://us-cert.cisa.gov/ncas/curre...e-discovered-popular-npm-package-ua-parser-js

Versions of a popular NPM package named ua-parser-js was found to contain malicious code. ua-parser-js is used in apps and websites to discover the type of device or browser a person is using from User-Agent data. A computer or device with the affected software installed or running could allow a remote attacker to obtain sensitive information or take control of the system.

CISA urges users and administers using compromised ua-parser-js versions 0.7.29, 0.8.0, and 1.0.0 to update to the respective patched versions: 0.7.30, 0.8.1, 1.0.1
Click to expand...

For more information, see Embedded malware in ua-parser-js.
Click to expand...

guest · Oct 23, 2021

mood said: ↑

Malware Discovered in Popular NPM Package, ua-parser-js October 22, 2021
Click to expand...

Popular NPM Package Hijacked to Publish Crypto-mining Malware
October 22, 2021
https://thehackernews.com/2021/10/popular-npm-package-hijacked-to-publish.html

The U.S. Cybersecurity and Infrastructure Security Agency on Friday warned of crypto-mining malware embedded in "UAParser.js," a popular JavaScript NPM library with over 6 million weekly downloads, days after the NPM repository moved to get rid of three rogue packages that were found to mimic the same library.

The supply-chain attack targeting the open-source library saw three different versions — 0.7.29, 0.8.0, 1.0.0 — that were published with malicious code on Thursday following a successful takeover of the maintainer's NPM account.

"I believe someone was hijacking my NPM account and published some compromised packages (0.7.29, 0.8.0, 1.0.0) which will probably install malware," UAParser.js's developer Faisal Salman said. The issue has been patched in versions 0.7.30, 0.8.1, and 1.0.1.
Click to expand...

The development comes days after DevSecOps firm Sonatype disclosed details of three packages — okhsa, klow, and klown — that masqueraded as the user-agent string parser utility with the goal of mining cryptocurrency in Windows, macOS, and Linux systems. It's not immediately clear if the same actor is behind the latest compromise.

"Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer," GitHub noted in an independent alert.
Click to expand...

Log in or Sign up

Crypto-miner found hidden inside three npm libraries

guest Guest

guest Guest

guest Guest

Log in or Sign up

Crypto-miner found hidden inside three npm libraries

guest Guest

guest Guest

guest Guest

Useful Searches