Someone hid a full RAT inside a fake npm package and…
0 reactions
Someone hid a full RAT inside a fake npm package and exfiltrated victim data to HuggingFace
A malicious npm package name `js-logger-pack`, went through 29 versions on the registry which was looking innocuous logger and ending as a binary dropper.
The payload it dropped was 81 MB of binary called MicrosoftSystem64 which is a full cross-platform RAT packaged as a Node.js Single Executable Application, so it shows up as a native binary to endpoint tools rather than a node process.
And the clever bit was instead of sending the stolen data directly to a C2 server, it uploads everything to private **HuggingFace** datasets using an embedded API token. So all exfiltration traffic appears as normal HTTPS requests to a legitimate ML platform.
If you have any of those in your install history then rotate everything like credentials, SSH keys, API tokens, crypto seed phrases. All packages list and full technical breakdown is in blog.
#dev #programming #technology
A malicious npm package name `js-logger-pack`, went through 29 versions on the registry which was looking innocuous logger and ending as a binary dropper.
The payload it dropped was 81 MB of binary called MicrosoftSystem64 which is a full cross-platform RAT packaged as a Node.js Single Executable Application, so it shows up as a native binary to endpoint tools rather than a node process.
And the clever bit was instead of sending the stolen data directly to a C2 server, it uploads everything to private **HuggingFace** datasets using an embedded API token. So all exfiltration traffic appears as normal HTTPS requests to a legitimate ML platform.
If you have any of those in your install history then rotate everything like credentials, SSH keys, API tokens, crypto seed phrases. All packages list and full technical breakdown is in blog.
#dev #programming #technology
| 3,000 mlx | |
| 7 | |
| 0 |