Security researchers have uncovered multiple campaigns targeting developers through malicious npm packages and VS Code extensions, posing significant supply chain risks.
## Discord-Connected npm Packages Harvest System Data
Researchers at Socket identified 60 malicious npm packages designed to collect sensitive system information and send it to Discord webhooks. Published under three different accounts (bbbb335656, cdsfdfafd1232436437, and sdsds656565), these packages have been downloaded over 3,000 times.
The malicious code executes during installation, fingerprinting machines while avoiding detection in virtualized environments. It harvests:
– Hostnames
– Internal and external IP addresses
– DNS server information
– User directories
– Network interface details
“By harvesting this data, threat actors can chart networks and identify high-value targets for future campaigns,” explained researcher Kirill Boychenko.
## Destructive JavaScript Packages Still Available
Another set of eight npm packages masquerading as helpers for popular frameworks like React, Vue.js, and Node.js contain destructive payloads. Despite being downloaded over 6,200 times, many remain available in the repository.
These packages execute automatically when invoked in projects, performing actions like:
– Recursively deleting framework files
– Corrupting JavaScript methods
– Tampering with browser storage mechanisms
– Initiating system shutdowns
The threat actor “xuxingfeng” published both malicious and legitimate packages, creating “a facade of legitimacy” according to researcher Kush Pandya.
## Sophisticated Phishing Campaign Leverages npm
Fortra discovered a novel attack combining email phishing with malicious JavaScript from an npm package. The campaign begins with phishing emails containing encrypted code hosted on jsDelivr, leading victims through redirections to fake Office 365 login pages designed to steal credentials.
## Malicious VS Code Extensions Target Crypto Wallets
Datadog Security Research identified three malicious VS Code extensions targeting Solidity developers:
– solaibot
– among-eth
– blankebesxstnion
These extensions, attributed to threat actor MUT-9332, offer genuine functionality while delivering malware that steals cryptocurrency wallet credentials. They install browser extensions capable of plundering Ethereum wallets and executables that disable Windows Defender.
The same threat actor is believed responsible for another campaign using 10 malicious VS Code extensions to install cryptominers disguised as coding or AI tools.