Credential-Stealing Trojan Planted in AsyncAPI npm Packages

A malicious campaign affecting AsyncAPI packages has been discovered in the Node Package Manager (npm) registry. The attackers published five counterfeit versions of the packages, which contained a remote access trojan (RAT) with built-in credential-theft capabilities.

A supply chain attack

AsyncAPI is a popular open-source project used by developers to describe and document event-driven APIs. The compromise of its npm packages is a classic example of a software supply chain attack, in which malicious code is distributed through the trusted distribution channels of legitimate libraries.

The implanted trojan was capable of remotely accessing infected systems, as well as stealing sensitive data, including users' credentials.

Risks for developers

Incidents like this underscore the vulnerability of the npm ecosystem, where millions of developers install third-party dependencies every day without closely inspecting their contents. The compromise of even a single widely used package can affect a great many projects that rely on it as a dependency.

Security specialists recommend that developers carefully check the versions of the packages they install, use tools that scan dependencies for known vulnerabilities and malicious code, and, wherever possible, pin library versions and review changelogs before updating.

Cases involving malicious npm packages are becoming ever more frequent, prompting the open-source community and package registry operators to strengthen their measures for monitoring and moderating published content.

Source: Bleeping Computer