InfoWorld

New npm malware finds a way around install script defenses

A malicious npm package reached over 2 million weekly downloads by hiding its payload in a routine library function rather than an install script.

Malicious npm packages evade install-script defenses at runtime

An ongoing npm malware campaign involving the 'indexed-btree' package shows how threat actors bypass supply chain defenses by ...
techtimes

Malicious JavaScript Evaded VirusTotal in Seven of Eight E-Commerce Storefront Attacks

Worker move goods for despatch in a redistribution centre of US online retail giant Amazon in Horn-Bad Meinberg, western Germany, on December 9, 2024. INA FASSBENDER/AFP via Getty Images Cloudflare's ...
cyberpress

npm Supply Chain Attack Hides Malware Inside Normal Package Code to Evade Detection

A new npm supply chain campaign is hiding malware inside ordinary JavaScript package code instead of using the usual ...
Security Affairs

JSCeal Hides Crypto Malware in V8 Bytecode

JSCeal hides crypto-stealing malware in V8 bytecode, but researchers built a tool to decompile it and expose its advanced theft capabilities.
cyberpress

GhostCode Abuses Microsoft Device Codes to Steal M365 Tokens and Register Rogue Devices

Sentire's Threat Response Unit (TRU) has uncovered a previously undocumented device-code phishing kit, dubbed "GhostCode," ...
cybersecuritynews

Hackers Abuse Google Sheets to Hijack Crypto Wallet Addresses in ClickFix Attacks

Hackers are using Google Sheets as an unlikely control channel in a cryptocurrency theft campaign. The operation turns a familiar browser session into a place where malicious code runs, rather than ...