HACKERS HIDE PULSAR RAT INSIDE PNG IMAGES IN NEW NPM SUPPLY CHAIN ATTACK

Summary from the TLDR InfoSec newsletter

Veracode researchers discovered a typosquatted NPM package called "buildrunner-dev" that delivers the Pulsar RAT by hiding malicious code within PNG images using steganography, extracting payloads from RGB pixel values at runtime. The attack chain employs a heavily obfuscated 1,600-line batch file with only 21 functional lines, detects and evades AV products like ESET and Malwarebytes, and uses process hollowing to inject the final payload into legitimate processes. Developers should carefully verify package names and audit dependencies, as supply chain attacks increasingly leverage image-based steganography to bypass traditional file-scanning tools.