Come riconoscere Cross Platform NPM Stealer Targets Browser Credentials and Crypto Wallets?

Come funziona

Security researchers discovered a Node.js based stealer that runs cross platform (Windows/WSL, macOS, Linux) and harvests credentials from 13+ browsers (Chrome, Brave, Edge, Opera, Vivaldi, Yandex, etc.) plus 100+ cryptocurrency wallet...

Indicatori rossi

• Attackers package Node.js stealer as an NPM package → developers unknowingly install malicious dependencies
• Malware targets localhost paths typical of WSL environments → a signal of sophisticated cross platform design
• Embedded plain text payloads reveal intent to steal browser stored credentials with zero user interaction needed

Cosa fare

1. 1Audit package.json dependencies: run npm audit or use socket.dev to scan for suspicious NPM packages
2. 2Never run untrusted NPM install scripts with npm install g or global flags
3. 3Rotate credentials if you installed NPM packages from unverified sources; enable 2FA on all accounts and store sensitive keys in dedicated hardware or vault tools

Fonte

FAQ