A new malicious package targeting NodeJS developers using Linux and macOS has been discovered hidden in a fake Browserify NPM package. . The malicious package is called "web-browserify," and imitates the popular Browserify npm component downloaded over 160 million times over its lifetime. web-browserify is itself built by combining hundreds of legitimate open-source components, and performs extensive reconnaissance activities on an infected system. Moreover, as of today, the ELF malware contained with the component has a zero detection rate by all leading antivirus engines. . The harmful module is named 'node-serve', and mimics the well-known Serve npm package to compromise devices.. NodeJS Threats, Linux Malware, MacOS Security, Open Source Risks. . LinuxSecurity.com Team
Get the latest Linux and open source security news straight to your inbox.