The NPM package with millions of downloads is at risk of malware kidnapping

• A popular NPM maintenance was prey to a phishing attack, sharing login credentials with cybercriminals
• The attackers accessed their NPM account and pushed malware through a popular package
• They were removed six hours later, but users must still be cautious

Experts have warned that ‘IS’, an NPM package with more than 2.8 million weekly discharges, was also compromised in the same way and served as malware for approximately six hours.

This occurs shortly after the configger control, another popular NPM package, was recently compromised in an attack on the supply chain that made him serve to malware, after his maintenance, Jounqin, he received an email that falsified the support account of [email protected], asking them to “verify” their account which one, when they did, they did to the attackers of login.