NPM Supply Chain Attack
Last modified: 2023-07-12
Malware
Supply Chain
An attacker might be able to lead an organization to install a malicious NPM package by abusing misconfiguration of the internal proxy server or package manager.
This page has lack of content yet.
Dependency Confusion
The PoC is available thanks to the researcher who discovered the threat.
Lock File Injection
Attackers may insert their malicious npm package into yarn.lock or package-lock.json in the target project.