The latest attack campaign unveils packages on npm designed to harvest Ethereum private keys by embedding malicious code, requiring developers to engage with the package for impact.
Phylum identified suspicious npm packages, notably ethers-mew, which not only steal Ethereum private keys but also enable attackers to gain SSH access by manipulating authorized_keys.
[
Collection
]
[
|
...
]