What happened
A malicious campaign involving a fake Web3 accelerator has been observed distributing malware through compromised npm packages. This campaign targeted organisations offering or using development tools related to artificial intelligence and Web3 technologies. The malicious npm packages were presented under the guise of providing free AI credits for services such as Anthropic Claude and Google Gemini, as well as coding tools and security assessments. When downloaded and installed, these packages delivered information-stealing malware and backdoors aimed at Windows and macOS systems. The malware can harvest sensitive information and establish persistent access to compromised machines, potentially enabling further malicious activity.
Who is affected
Organisations running Windows and macOS systems that have engaged with or installed software from the compromised npm packages are at risk. Such environments may include development teams, security operations, and organisations working within the AI, Web3, or software development sectors. The impact on affected deployments depends on whether the malware was successfully delivered and executed, which could lead to data theft or further exploitation of system vulnerabilities.
Recommended actions
- Review any recent installations or updates involving npm packages, especially those purportedly offering AI credits, coding tools, or security audits.
- Verify the origin and integrity of npm packages before installation, avoiding packages from untrusted sources or those with suspicious naming conventions.
- Implement network controls to restrict or monitor outbound traffic from affected systems, focusing on unusual communication patterns which may indicate malware activity.
- Monitor systems for behaviours associated with information theft or backdoor activity, such as unexpected data transmissions or unfamiliar processes.
