These packages include,
According to npm, all versions of these packages contained malicious codes. In turn, the packages compromised complete systems opening shells on it to a remote server. npm has warned that any system running any versions of these packages should be considered fully compromised.Besides, npm also removed one more malicious package from the portal, npmpubman. This package contained codes
According to the package details, all these packages existed on the portal for about a year with many downloads.
This package contained malicious code and was removed from the registry by the npm security team. A placeholder was published to ensure users are not affected in the future.However, the threat continues to persist for any systems that are still running any of these packages.
Therefore, users must ensure checking their systems and removing the malicious package(s).
For the three packages opening shells on target systems, nodetest199, nodetest1010, and plutov-slack-client npm recommended,
All secrets and keys stored on that computer should be rotated immediately from a different computer.Although, they have warned that complete removal of the packages may not warrant remediation.
The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.Whereas, for npmpubman victims, npm advises removal of the package and rotating compromised credentials as a remedy.
