VYPR
← All malware advisories

npm · Malicious package advisory

Malware

bugsnagmw

MAL-2024-1199

Malicious code in bugsnagmw (npm)

Details

The package `bugsnagmw` (npm) version 1.0.3 contains malicious code. The code was obfuscated to avoid detection. The malicious code is designed to steal sensitive information from the user's environment and send it to a remote server. See https://stacklok.com/blog/analysis-of-an-obfuscated-code-attack-on-npms-package-registry for more details.

Compromised versions (4)

  • 1.0.0
  • 1.0.1
  • 1.0.2
  • 1.0.3

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.