Malicious npm Packages Opened Shells On Windows and Linux Systems

  •  
  •  
  •  
  • 1
  •  
  •  
  •  
    1
    Share

Once again, the npm security team has caught a bunch of malicious npm packages on the portal. These npm packages opened shells on target Windows and Linux devices.

npm Packages Opened Shells On Windows, Linux

The security team at npm has published back-to-back advisories about multiple malicious npm packages. Specifically, three of these opened shells on the target Windows and Linux systems after download.

These packages include,

According to npm, all versions of these packages contained malicious codes. In turn, the packages compromised complete systems opening shells on it to a remote server. npm has warned that any system running any versions of these packages should be considered fully compromised.

Besides, npm also removed one more malicious package from the portal, npmpubman. This package contained codes

According to the package details, all these packages existed on the portal for about a year with many downloads.

Malicious Packages Now Removed, But…

Upon detecting the malicious packages, team npm removed them from the portal whilst placing the following description on their pages.

This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.

However, the threat continues to persist for any systems that are still running any of these packages.

Therefore, users must ensure checking their systems and removing the malicious package(s).

For the three packages opening shells on target systems, nodetest199, nodetest1010, and plutov-slack-client npm recommended,

All secrets and keys stored on that computer should be rotated immediately from a different computer.

Although, they have warned that complete removal of the packages may not warrant remediation.

The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

Whereas, for npmpubman victims, npm advises removal of the package and rotating compromised credentials as a remedy.

The following two tabs change content below.

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Abeerah Hashim

Abeerah has been a passionate blogger for several years with a particular interest towards science and technology. She is crazy to know everything about the latest tech developments. Knowing and writing about cybersecurity, hacking, and spying has always enchanted her. When she is not writing, what else can be a better pastime than web surfing and staying updated about the tech world! Reach out to me at: [email protected]

Do NOT follow this link or you will be banned from the site!