A widely used repository is infected with hidden malware

Password-stealing package outed by security firm evokes sense of déjà vu

Abusing Google ChromePass Utility

Researchers at ReversingLabs have disclosed their findings on two malicious NPM packages that secretly steal passwords from your Chrome web browser

A software package available from the official NPM repository has been revealed to be actually a front for a tool that's designed to steal saved passwords from the Chrome web browser

In light of the growing number of cyber incidents that target the software supply chain, there is an urgent need to assess such third-party modules for any security risks and minimize the attack surface, ReversingLabs researcher Karlo Zanki said in a report shared with The Hacker News.