FlagThis

Multiple npm packages are posing as useful, open-source utilities to retrieve an external IP address, but are actually malicious executables targeting Windows, Linux, and macOS users. These trojans are designed to steal cryptocurrency from unsuspecting developers. The malicious packages have been identified as “node-request-ip,” “request-ip-validator,” and “node-request-ip-validator.” These packages lure developers with their simple purpose, making it easier for the malicious code to sneak in undetected. These packages are not genuine and should not be installed or used. Developers and users are advised to exercise caution and only install packages from trusted sources.

References:

• Malware Analysis, News and Indicators - This post provides details about the malicious npm packages, "node-request-ip," "request-ip-validator," and "node-request-ip-validator." It highlights their fraudulent nature, targeting developers wit - 9d
• 2024 Sonatype Blog - This blog post discusses the malicious npm packages impersonating legitimate IP checker utilities. It warns developers to exercise caution and avoid installing these packages. - 9d

Classification:

• HashTags: npm malware cryptostealer
• Company: npm
• Target: developers
• Product: npm packages
• Feature: IP checker utilities
• Type: Malware
• Severity: Major