Fake Web3 Accelerator Spreads Malware via npm Packages and Hijacks AI Agent Traffic

Summary: A deceptive Web3 accelerator is deploying info-stealers and backdoors to Windows and macOS systems through malicious npm packages. These attacks target users with promises of free AI credits for Anthropic Claude and Google Gemini.

A new cybersecurity threat involves a fake Web3 accelerator distributing malware through npm packages. This attack specifically targets developers and users interested in AI technologies. Attackers lure victims with enticing offers like free AI credits, tricking them into downloading malicious packages.

The attack mechanism relies on software supply chain attacks. Malicious npm packages are published under seemingly legitimate names and integrated into developers’ projects. When these packages are installed, they deploy info-stealers and backdoors onto systems. Furthermore, the ability to hijack AI agent traffic is one of the dangerous aspects of this attack.

From a live systems and infrastructure perspective, such attacks pose severe security risks in development environments. Malware infecting a developer’s machine can gain access to corporate networks, source code repositories, or production systems. Specifically, the hijacking of AI agent traffic could lead to the leakage of sensitive data or manipulation of AI models.

Engineers must be extremely cautious when using open-source packages. Verifying the source and trustworthiness of every package downloaded from package managers like npm is critical. Additionally, implementing strict security policies in development environments, performing dependency scanning, and operating with unprivileged users can increase resilience against such supply chain attacks.

🔗 Source: The Hacker News
📡 Authoritative feeds & live tracking: Radar