Crypto-Themed npm Packages Found Delivering Stealthy Malware

On October 30, 2023 Phylum’s automated risk detection platform alerted us to a strange publication to npm called puma-com. Upon investigation, we found a very convoluted attack chain that ultimately pulled a remote file, manipulated it in place, called an exported function from that file, and then meticulously

attack attack chain automated called crypto detection file found function investigation malware npm october packages phylum platform pulled puma research risk ultimately