JavaScript package manager npm removes malicious packages that were stealing data

JavaScript programming language package manager npm have disclosed and removed approximately 40 malware spiked packages that were designed to steal environment variables and the series of packages with names were similar to existing and popular npm packages.

The developers confirm the news that this is a case of typo squatting to distract inattentive users and they were slightly different than the usual package.

" Environmental variables are such common a way to hand credentials to software, it' s a pretty good thing to go after," said CJ Silverio, CTO at npm.

According to npm, a user by the handle name “ hacktask” published the malicious libraries on July 19 included the popular “ crossenv” as “ cross-env” and it has been downloaded 700 times before it was taken down. Fortunately only 50 users appear to be genuine installation while the rest seems to be registry mirrors.

" If you downloaded and installed any of these packages, you should immediately revoke and replace any credentials you might have had in your shell environment," npm advised.

Steps are taken to ensure to prevent further typo squatting problem by using the block publication option that detects spams as it is published to the registry.