The NPM package with millions of downloads is at risk of diversion of malware

• An official of the popular NPM has become the prey of a phishing attack, sharing information to connect with cybercriminals
• The attackers acceded to their NPM account and pushed malware via a popular package
• They were deleted six hours later, but users should still be cautious

Experts have warned that “IS”, an NPM package with more than 2.8 million weekly downloads, was also compromised in the same way and served malware for about six hours.

This occurs shortly after Eslint-Config-Prettier, another Popular NPM package, was recently compromised in a supply chain attack which has served malware, after its maintainer, Jounqin, received an e-mail that has usurped the account of [email protected], asking them to “check” their account which, when they did the attackers faithful.