+1 607 252-6647 Email Questions

Three npm packages found opening shells on Linux, Windows systems

  • Published in News
  • Hits: 35

Three JavaScript packages have been removed from the npm portal[1] on Thursday for containing malicious code.

According to advisories from the npm security team, the three JavaScript libraries opened shells on the computers of developers who imported the packages into their projects.

The shells, a technical term used by cyber-security researchers, allowed threat actors to connect remotely to the infected computer and execute malicious operations.

The npm security team said the shells could work on both Windows and *nix operating systems, such as Linux, FreeBSD, OpenBSD, and others.

Packages were live for almost a year

All three packages were uploaded on the npm portal almost a year ago, in mid-October 2019. Each package had more than 100 total downloads since being uploaded on the npm portal. The packages names were:

"Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer," the npm security team said.

"The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it," they added.

Npm's security staff regularly scans its collection of JavaScript libraries, considered the largest package repository for any programming language.

While malicious packages are removed on a regular basis, this week's enforcement is the third major crackdown in the last three months.

In August, npm staff removed a malicious JavaScript library designed to steal sensitive files from an infected users' browser and Discord application[5].

In September, npm staff removed four JavaScript libraries for collecting user details and uploading the stolen data to a public GitHub page

Read more from our friends at ZDNet

Contact us

By Mail

PO Box 5613

Katy, TX 77491


Social: twitter facebook

Phone: +1 607 252-6647

Fax: +1 866 573-1096

Email: info [AT] synapticweb [DOT] co