Someone may be ramping up an NPM crypto-mining spree
In the most recent case, Checkmarx researchers noted a flood of suspicious NPM users and packages being automatically created over a number of days, with all of the packages containing code that is almost identical to the Eazyminer package, designed to mine Monero by utilizing unused resources of such machines as CI/CD and web servers.
"Downloading and installing these packages will have no negative effect on the machine," the researchers wrote."The copied code from Eazyminer includes a miner functionality intended to be triggered from within another program and not as a standalone tool. The attacker didn't change this feature of the code and for that reason, it won't run upon installation."
"At the heart of these packages are the XMRig miners," the researchers wrote."Their binaries, compiled for Windows and Linux systems, are shipped along with the packages. The attacker changes the names of these binaries to match the random names of the package themselves."
Canada Latest News, Canada Headlines
Similar News:You can also read news stories similar to this one that we have collected from other news sources.
Light shone on typo-squatting NPM supply chain attackTypo-squatting NPM software supply chain attack uncovered
Read more »
Light shone on typo-squatting NPM supply chain attackTypo-squatting NPM software supply chain attack uncovered
Read more »
Crypto’s last man standingIs Sam Bankman-Fried the John Pierpont Morgan of crypto?
Read more »
Appeal as vulnerable man targeted in attempted burglary in WisbechHe saw someone using a screwdriver to try accessing a window
Read more »
Singapore in talks for international crypto investment rulesSingapore reveals international talks on protection for retail crypto investors
Read more »
AstraLocker ransomware closes doors to pursue cryptojackingWhy go through the hassle of demands and decryption when quietly mining is so much easier?
Read more »