Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 513
Alerts This Week
Warning Icon 1 513

Stop Npm Malware: Protect Linux and Other Systems from Cryptominers

Calendar Oct 21, 2021 • User Avatar Anthony Pell
1 min read
22.Lock ScreenEffect Esm H446
Topics%20covered

Topics Covered

Linux threats cryptocurrency mining npm malware JavaScript package Windows threats MacOS threats

Multiple malicious packages have been identified on the npm registry this month. These packages disguise themselves as legitimate JavaScript libraries, but have been caught launching cryptominers on Linux, Windows and MacOS machines.

The malicious packages are:

  • okhsa
  • klow
  • klown

“klow, klown” have been tracked under Sonatype-2021-1472. Whereas, “okhsa” has been cataloged under Sonatype-2021-1473.

Different versions of the “okhsa” package largely contain skeleton code that launches the Calculator app on Windows machines pre-installation. But additionally, these versions contain either the “klow” or the “klown” npm package as a dependency—which is malicious.

 

 

The link for this article located at Security Boulevard is no longer available.