Nine npm lookalikes carried a self-spreading Linux worm
Attackers have disguised nine malicious npm packages as popular Express and React tools, triggering a self-spreading Linux worm during installation.
R/PROGRAMMING (TOP) — The malware establishes a backdoor via Tor and steals SSH access and npm tokens to infect other systems.
When developers install what they believe to be standard Express or React packages, they may unknowingly execute a Linux worm at installation time. This threat spreads through multiple vectors, including SSH connections and Arch User Repository (AUR) packages, because it extracts active credentials such as npm tokens from infected environments.
First, the malware installs a backdoor using the Tor network, which anonymizes the attackers' command traffic. Second, it searches for local keys to hop to other servers, meaning a single compromised development environment can expose an entire internal network.
Readers’ Forum
No contributions yet — open the debate.
Open the discussion
No account or password needed — just enter your e-mail and we’ll send you a one-time sign-in link. First time here? You’re set up automatically.
Your rating will be applied automatically after you sign in.
Check your inbox
We’ve sent a sign-in link to …. Open it on this device — this tab will sign you in automatically.
Nothing arrived? Check your spam folder — and mark the mail as "Not spam" so it lands in your inbox next time.