Fake npm Packages Impersonate PostCSS Tool to Steal Chrome Passwords
Cybersecurity research firm JFrog reveals a new technique in its latest report that cybercriminals are using to target software developers, tricking them into downloading remote access trojans (RATs). This operation relies on an attack method called package impersonation, in which malicious packages are uploaded as trusted utilities to attract developers.
According to JFrog’s investigation, attackers have uploaded three connected malicious packages onto the npm registry to get developers to install them by mistake. The primary fake package is named postcss-minify-selector-parser. It looks almost identical to postcss-selector-parser, a highly popular legitimate utility with over 150 million weekly downloads.
Because the fake tool shares similar keywords and lists the genuine package as a dependency, it easily bypasses basic code reviews. JFrog found that an npm user named abdrizak published this code along with two other interconnected packages: postcss-minify-selector and aes-decode-runner-pro.
The Multi-Stage Infection
When a developer imports the fake package, the...
Copyright of this story solely belongs to hackread.com. To see the full text click HERE
