Security LandDec 21

The Koi Security research team is on a roll this week.

After exposing the GhostPoster campaign that hid malware in Firefox extension logos, they've now uncovered something that should concern every developer using npm: a WhatsApp API package with 56,000 downloads that steals everything passing through it.

#SecurityLand #CyberWatch #NPM #WhatsApp #API #MaliciousPackage #Koi

Read More: https://www.security.land/whatsapp-stealing-malware-lurked-in-npm-package-with-56-000-downloads/

NPM Malware Steals WhatsApp Messages: 56K Downloads of Lotusbail

Researchers at Koi Security have uncovered a malicious npm package that stole WhatsApp credentials and messages while functioning perfectly as a legitimate API library. The lotusbail package accumulated over 56,000 downloads in six months.

Security Land | Decoding the Cyber Threat Landscape
circlNov 20

The @openssf OpenSSF Malicious packages provides a continuous feed about compromised and abuse software packages.

The source is included in vulnerability-lookup and available on the CIRCL instance.

🔗 https://vulnerability.circl.lu/recent#ossf_malicious_packages

#cybersecurity #openssf #maliciouspackage #vulnerabilitymanagement

Recent vulnerabilities - Vulnerability-Lookup

Vulnerability-Lookup - Fast vulnerability lookup correlation from different sources.

ITSEC NewsJan 15, 2020
Malicious npm package taken down after Microsoft warning - Criminals have been caught trying to sneak a malicious package on to the popular Node.js platform ... more: https://nakedsecurity.sophos.com/2020/01/15/malicious-npm-package-taken-down-after-microsoft-warning/ #microsoftvulnerabilityresearch #nodepackagemanager #maliciouspackage #securitythreats #vulnerability #microsoft #backdoor #unix #npm
Malicious npm package taken down after Microsoft warning

Naked Security