Three npm packages found opening shells on Linux, Windows systems

Three JavaScript packages have been removed from the npm portal on Thursday for containing malicious code.

According to advisories from the npm security team, the three JavaScript libraries opened shells on the computers of developers who imported the packages into their projects.

The shells, a technical term used by cyber-security researchers, allowed threat actors to connect remotely to the infected computer and execute malicious operations.

The npm security team said the shells could work on both Windows and *nix operating systems, such as Linux, FreeBSD, OpenBSD, and others.

Packages were live for almost a year

All three packages were uploaded on the npm portal almost a year ago, in mid-October 2019. Each package had more than 100 total downloads since being uploaded on the npm portal. The packages names were:

« Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer, » the npm security team said.

« The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it, » they added.

Npm’s security staff regularly scans its collection of JavaScript libraries, considered the largest package repository for any programming language.

While malicious packages are removed on a regular basis, this week’s enforcement is the third major crackdown in the last three months.

In August, npm staff removed a malicious JavaScript library designed to steal sensitive files from an infected users’ browser and Discord application.

In September, npm staff removed four JavaScript libraries for collecting user details and uploading the stolen data to a public GitHub page.