The npm security team has removed the JavaScript library “fallguys” from the npm portal because it was containing a malicious code used to steal sensitive files from an infected users’ browser and Discord application.
The fallguys library claimed to provide an interface to the “Fall Guys: Ultimate Knockout” game API. The package was available the repository for two weeks and was downloaded nearly 300 times.
“fallguys contained malicious code that attempted to read local sensitive files and exfiltrate information through a Discord webhook.” reads the npm’s advisory.
Every project that integrated the malicious library, upon execution will get the malicious code executed.
Experts noticed that the malicious package was designed to steal only specific sensitive information from the infected developers’ systems.
This malicious code would attempt to access the content of the following five local files and then post the data inside a Discord channel:
The first four files are LevelDB databases used common browsers like Chrome, Opera, Yandex Browser, and Brave. The files contain a user’s browsing history data.
The /AppData/Roaming/discord/Local\x20Storage/leveldb file is a sort of LevelDB database for the Discord Windows client that is used to store information on the channels a user has joined.
Experts speculate the malicious package was used to gather information on developers using it, such as the sites they were accessing.
“Remove the package from your system and ensure any compromised credentials are rotated.” concludes the advisory.
[adrotate banner=”9″] | [adrotate banner=”12″] |
(SecurityAffairs – hacking, npm)
[adrotate banner=”5″]
[adrotate banner=”13″]
The MITRE Corporation revealed that a nation-state actor compromised its systems in January 2024 by…
China-linked threat actors are preparing cyber attacks against U.S. critical infrastructure warned FBI Director Christopher…
The United Nations Development Programme (UNDP) has initiated an investigation into an alleged ransomware attack…
BlackBerry reported that the financially motivated group FIN7 targeted the IT department of a large…
An international law enforcement operation led to the disruption of the prominent phishing-as-a-service platform LabHost.…
Russia-linked APT Sandworm employed a previously undocumented backdoor called Kapeka in attacks against Eastern Europe since…
This website uses cookies.