Target Industry

Indiscriminate, opportunistic targeting.

Overview

Security researchers at Socket in the US have discovered of over 70 malicious Node Package Manager (npm) and Visual Studio Code (VS Code) packages. These packages were designed to steal sensitive data and cryptocurrency from users. 

Impact

The impact to the organisation is likely to be high due to the theft of sensitive data and cryptocurrency. It can lead to significant financial losses and reputational damage for developers and organisations. 

Exploitation

Threat actors use sophisticated phishing attacks that combine traditional email phishing with malicious npm packages, leading victims to fake Office 365 login pages to steal credentials. Another method they use is typosquatting, where they create names similar to legitimate packages, such as flipper-plugins and react-xterm, to trick users into downloading them. 

These packages contain a post-install script that exfiltrates sensitive data during the npm install process. The script checks for hostnames related to cloud providers and reverse DNS strings to ensure it is not running in a sandbox environment, thereby avoiding detection. 

Indicators of Compromise

Containment, Mitigations & Remediations

It is highly recommended to: 

• use tools such as npm audit to check for vulnerabilities in npm packages and verify the authenticity of packages before installation.  

• Enable multi-factor authentication for all accounts, especially for services like Office 365, to add an extra layer of security.  

• Regularly review and audit code dependencies to ensure no malicious code is introduced. 

• Test new packages in a sandbox environment to detect any malicious behaviour before deploying them in production. 

• Users who have downloaded any of the malicious packages are advised to remove the packages immediately 

Threat Landscape

The discovery highlights significant security vulnerabilities in the software development supply chain. It also underscores the importance of vigilance and robust security measures in software development. 

This includes implementing thorough code reviews, using secure coding practices, and regularly auditing dependencies to prevent malicious packages from infiltrating the development process. 

Additionally, educating developers about potential threats and ensuring they follow best practices can further enhance the security of the software supply chain. 

Threat Group

There is a possible link to Mysterious Unattributed Threat (MUT) 9332 as they primarily targeting developers using Visual Studio Code and npm packages. They have been seen to distribute a Monero cryptominer and have targeted Solidity developers with trojanised VS Code extensions. 

Further Information

https://thehackernews.com/2025/05/over-70-malicious-npm-and-vs-code.html 

https://rewterz.com/threat-advisory/malware-alert-mut-9332-infects-solidity-devs-through-vs-code-active-iocs