npm package downloads another package while exfiltrating your IP address and username

On any given day, Sonatype's security research team analyzes dozens to hundreds of suspicious packages published to open source registries including npm and PyPI.

The post npm package downloads another package while exfiltrating your IP address and username appeared first on Security Boulevard.

address dependency confusion devzone downloads featured ip ip address malware prevention nexus firewall npm npm package package username vulnerabilities