I received a fake job offer. The NPM package was a full info-stealer
An individual received a fake job offer that led to an NPM package containing a full information-stealing malware. The attack was part of a supply chain compromise, demonstrating how cybercriminals use fake recruitment to distribute malicious code.
Background
- **NPM (Node Package Manager)** is a massive repository of open-source JavaScript code packages used by most modern web applications. Developers install these packages (dependencies) to avoid rewriting common functionality — but malicious packages can spread through the same system.
- **Supply-chain attack**: Instead of hacking a target directly, attackers compromise a trusted dependency. One malicious package can infect every project that uses it, reaching thousands of downstream users.
- **Fake job-offer malware** is an increasingly common social-engineering tactic. Attackers pose as recruiters, send a "coding test" or "pre-employment task" that contains hidden malware, and steal credentials, crypto wallets, SSH keys, and session cookies when the victim runs it.
- **Info-stealer** malware exfiltrates sensitive data from the victim's machine (browser passwords, crypto wallets, environment variables, etc.) to a remote server controlled by the attacker.
- This post is a first-hand account of an attempted attack using a malicious NPM package disguised as a legitimate job assessment, likely targeting developers working with Node.js or related ecosystems.