Someone hid a full RAT inside a fake npm package and exfiltrated victim data to HuggingFace
A malicious npm package name js-logger-pack, went through 29 versions on the registry which was looking innocuous logger and ending as a binary dropper. The payload it dropped was 81 MB of binary called MicrosoftSystem64
📄
This source provides headlines only. Use the button below to read the complete article on the original site.
📰 Read the original article on r/programming
Originally published by r/programming. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.