MALICIOUS NPM PACKAGE REACT-REFRESH-UPDATE DROPS CROSS-PLATFORM TROJAN ON DEVELOPER MACHINES

Summary from the TLDR InfoSec newsletter

SafeDep identified react-refresh-update, a typosquat of Meta's react-refresh (42M weekly downloads) that injected a two-layer XOR-obfuscated dropper into runtime.js — executing silently on require() with no install hooks — and attributed the C2 domain malicanbur[.]pro and secondary IP 173.211.46[.]22:8080 to Lazarus Group's DeceptiveDevelopment campaign, with the second-stage binary independently classified as PylangGhost RAT by multiple AV vendors. The payload is OS-aware: on Windows, it fetches a 28.71 MB self-extracting archive via chunked axios range requests and executes start.vbs via a hidden, detached wscript process. On Linux and macOS, it downloads and executes /var/tmp/macspatch.sh with TLS verification disabled. The encrypted-in-memory eval() execution pattern evades static analysis tools scanning for child_process references, making this campaign a notable escalation in AI coding agent supply chain targeting, where inflated version numbers and mirrored codebases can pass automated package selection without human review.