DOZENS OF NPM PACKAGES CAUGHT ATTEMPTING TO DEPLOY REVERSE SHELL

Summary from the TLDR InfoSec newsletter

Phylum's automated risk detection platform alerted them to a campaign involving at least 48 different publications on npm. These packages, published by the npm user "hktalent" with a package called rshNpm, contained obfuscated JavaScript designed to initiate a reverse shell on package install. The attack chain is triggered by package installation via an install hook in the package.json.