Malicious javascript compromise on npmjs.com
These packages, about a billion downloads prior
supports-hyperlinks
chalk-template
simple-swizzle
slice-ansi
error-ex
is-arrayish
wrap-ansi
backslash
color-string
color-convert
color
color-name
Thread follows.
A bunch of packages published by qix in NPM just got backdoored it looks like. Obfuscated code was added like two hours ago. #threatintel #npm
Affected websites would largely run fine but if they were handling crypto transactions, the request is altered to the benefit of the attackers, sending funds to their wallet instead.
JavaScript let's you redefine standard features, and the malicious script redefines fetch, which is the standard function for calling URLs
Kevin Beaumont
Matthew Booth
Cassandrich
Bernard Quatermass
Davey