Crypto Chaos: Malicious NPM Packages Redirect Users to Scam Sites
Beware of “dino_reborn” packages on npm that use Adspect to separate researchers from victims, leading unsuspecting users to cryptocurrency scams. Six out of seven packages feature malicious code, masquerading as decoys but secretly gathering data to execute a cloaking scheme. Remember, not everything named “dino” is a friendly dinosaur!
Hot Take:
In the latest episode of “How to Lose Friends and Influence People (to Click on Crypto Scams),” a developer channeling their inner Dr. Evil has unleashed seven npm packages with an identity crisis—six are evil, and one just can’t decide. Our villain, ‘dino_reborn,’ is surely hoping for a Nobel Prize in the category of ‘Most Creative Use of Adspect.’ I mean, who doesn’t want their browser fingerprinted and judged by the Adspect jury?
Key Points:
- Seven npm packages were published by ‘dino_reborn,’ with six containing malicious code.
- The attack uses Adspect to separate researchers from potential victims.
- Malicious code, wrapped in IIFE, automatically executes on page load.
- Targets are redirected to fake crypto scam sites, while researchers see a decoy page.
- Adspect claims to block unauthorized access but hasn’t responded to queries about abuse.