Security checks bypassed by new npm malware

Novel npm malware discovered by JFrog researchers has been exploiting unexpected npm command line interface tool behavior to bypass the detection of security systems, reports The Hacker News. Even though package and dependency vulnerability checking has been built in npm CLI's install and audit commands to warn developers regarding npm package flaws, security advisories would not be shown for packages with some version formats, as well as pre-release versions of an npm module, according to the report. "Threat actors could exploit this behavior by intentionally planting vulnerable or malicious code in their innocent-looking packages which will be included by other developers due to valuable functionality or as a mistake due to infection techniques such as typosquatting or dependency confusion," said researcher Or Peles. The findings should prompt developers to refrain from installing pre-release versions of npm packages without thorough vetting of their sources, researchers noted.