NEW MALICIOUS NPM PACKAGE “AMBAR-SRC” TARGETS DEVELOPERS WITH OPEN SOURCE MALWARE

Summary from the TLDR InfoSec newsletter

The malicious npm package “ambar-src” accumulated ~50,000 downloads in just three days by typosquatting the popular “ember-source” package and abusing npm's preinstall script hook to execute code without any explicit import. The package deployed OS-specific open-source malware payloads, including encrypted shellcode on Windows, a Golang-based reverse SSH shell on Linux, and the Apfell/MythicAgents payload on macOS, all communicating via Yandex Cloud functions for C2 evasion. Organizations should audit dependencies for this package, treat any system where it was installed as fully compromised, and rotate all secrets from a separate machine.