Off-topic for aiqbench

This story was gathered from a source we follow but falls outside AI and quantum coverage, so there is no aiqbench take for it.

Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code

Cybersecurity NewsSeptember 21, 20264 min read

A malicious npm package that appeared to be an ordinary data-indexing tool has exposed a weakness in software supply-chain defenses. The package, indexed-btree, copied the identity of the legitimate sorted-btree library and recorded almost two million weekly downloads. The campaign is notable because the malware does not need to run while a developer installs it. […] The post Malicious npm Package With 2 Million Downloads Hides Malware in Runtime Code appeared first on Cyber Security News.

A malicious npm package that appeared to be an ordinary data-indexing tool has exposed a weakness in software supply-chain defenses. The package, indexed-btree, copied the identity of the legitimate sorted-btree library and recorded almost two million weekly downloads. The campaign is notable because the malware does not need to run while a developer installs it. Instead, it waits inside normal application code and activates when the library is used, turning a trusted…

Excerpt shown under the publisher's RSS terms · 72 words · full text and figures are on the publisher's site

Read at Cybersecurity News ↗Ask about this article