Online Threat Alerts (OTA) - Alerting you to scams and frauds.

Javascript Libraries Scams and Chain Attacks
Javascript Libraries Scams and Chain Attacks

"JavaScript library scams" primarily refer to supply chain attacks where malicious code is hidden inside popular software packages to steal data or money. These scams often target developers to gain access to their systems or use the trust of popular libraries to infect millions of end-user browsers.

Common Types of Scam

  • Credential Theft (Phishing): Attackers send phishing emails to library maintainers (often impersonating npmjs.com support) to steal their login tokens. Once they have access, they publish malicious "updates" to popular packages.
  • Cryptocurrency Drainers: Malicious code is injected into libraries to intercept or replace wallet addresses during transactions. This redirects funds from the user to the attacker.
  • Worming Attacks: A sophisticated worm known as Shai-Hulud has infected over 500 NPM packages. It automatically spreads by traversing GitHub repositories, stealing API keys and cloud service tokens along the way.
  • Malicious CDNs: In 2024, the popular polyfill.io domain was purchased by a company that modified the hosted library to redirect users to scam websites and steal sensitive data.
  • Dependency Confusion: Attackers publish malicious packages with names identical to internal company libraries, tricking automated systems into downloading the fake public version instead of the real private one.
waiting