SlowMist said its MistEye system detected a coordinated malicious npm supply chain campaign that used fake trading-bot repositories and DeFi-themed npm packages to distribute a JavaScript information-stealing tool to npm users, DeFi developers, and trading-bot users. According to Foresight News, the activity involved 30 malicious npm packages, including
[email protected], which appeared as a locked dependency in the repository donoaccestag/forex-mt5-trading-bot.
SlowMist said the repository showed clear abnormal signals, including reliance on malicious npm packages that had already been reported by security researchers. It also flagged about 2,300 highly similar forks that may have been generated in bulk, mainly concentrated under the poly-stocks account.
The potential attacker’s actions may include stealing local sensitive data such as cryptocurrency wallets, browser cookies, saved passwords, browsing history, developer credentials, shell history, password manager vaults, private keys, seed phrases, and API tokens found in source code.
SlowMist advised developers to immediately remove the affected npm packages and audit package.json, package-lock.json, and CI logs to identify the 30 malicious packages. It also recommended treating any system that has run npm install as potentially compromised, promptly rotating exposed wallets, private keys, npm tokens, cloud credentials, SSH keys, and API tokens, and rebuilding affected environments from clean images.
Weatherly
