Another set of malicious npm package were caught stealing Discord environment variables and tokens

JFrog Security, a DevOps security firm, today announced that it discovered and helped remove 25 malicious JavaScript library from the official npm package repository.

The company stated that all 25 libraries mirrored the names of other libraries in a statement. blog post today, hoping that developers would accidentally include them in their projects when mistyping names or not researching a package’s origin thoroughly enough.

JFrog claimed that the libraries also contained malicious code of different types, which suggests that they were created and maintained by different threat actors with different goals.

Seventeen libraries were set up to steal Discord access keys from the computers that ran the malicious code.

Although it may sound odd, Discord tokens are actually a valuable resource. They function in a similar way to browser authentication cookies. This allows attackers to gain access to accounts without having to provide a password.

These tokens are often traded underground and are commonly used by spammers to gain access user accounts. They then flood Discord channels with ads and malicious links.

Five other packages contained code that stole environment variables from the infected projects, which are details from a developer’s local programming environment.

These variables usually store OS information but can also contain API keys or login credentials for cloud services. This is information that many attackers love to collect.

But the most dangerous package was the last three. They allowed attackers access to user systems via Python code and shell commands.

JFrog described the threat actors as “novice hackers” since all they’ve done was to copy a legitimate package and then insert the malicious functionality. The research team said that while all of this involved minimal effort, if the packages weren’t detected, the attacks would have had a high return on investment (ROI), which is why they expect to see similar malicious packages flood the npm repository in the future.

JFrog discovered malicious npm packages that were designed to steal Discord tokens.

Below is a list of 25 malicious npm library addresses.