New Malware Campaign Targets Cryptocurrency Users Through Malicious npm Packages
Cybersecurity researchers have detected a new malware campaign dubbed “Ghost,” which uses malicious npm packages to steal cryptocurrency wallets and sensitive data. Identified by ReversingLabs, these packages—published by a user known as “mikilanjillo”—include seemingly benign names like “react-performance-suite” and “coinbase-desktop-sdk.”
The attack tricks users into entering their administrator passwords under the guise of performing system optimizations. Once the password is captured, the malware retrieves additional malicious payloads via a Telegram channel, ultimately deploying a remote access trojan capable of harvesting sensitive information.
Developers using these packages are at risk, with potential data breaches leading to significant financial losses. To protect against such threats, users should verify package sources, avoid entering passwords during installations, and employ robust antivirus software.
Risk Level: High
Source: View Original Report
