Get the latest tech news
Lazarus Group deceives developers with 6 new malicious NPM packages
Socket researchers said the malware-ridden packages were collectively downloaded over 330 times. GitHub removed all of the malicious packages Wednesday.
Lazarus Group has burrowed deeper into the npm registry and planted six new malicious packages designed to deceive software developers and disrupt their workflows, researchers at cybersecurity firm Socket said in a Monday blog post. Lazarus Group also “created and maintained GitHub repositories for five of the malicious packages, lending an appearance of open source legitimacy and increasing the likelihood of the harmful code being integrated into developer workflows,” Boychenko added. The malware also targets cryptocurrency wallets by extracting id.json from Solana and exodus.wallet from Exodus, which are then uploaded to a hardcoded C2 server, echoing another Lazarus Group tactic involving of harvesting and transmitting stolen data, Socket researchers said.
Or read this on Hacker News
