{"id":36899,"date":"2020-08-31T14:29:03","date_gmt":"2020-08-31T14:29:03","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/31528\/Malicious-npm-Package-Caught-Stealing-Discord-Browser-Files.html"},"modified":"2020-08-31T14:29:03","modified_gmt":"2020-08-31T14:29:03","slug":"malicious-npm-package-caught-stealing-discord-browser-files","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/malicious-npm-package-caught-stealing-discord-browser-files\/","title":{"rendered":"Malicious npm Package Caught Stealing Discord \/ Browser Files"},"content":{"rendered":"
\"npm-malicious.png\"<\/span>
<\/span><\/figcaption><\/figure>\n
\n

techrepublic cheat sheet<\/span> <\/h3>\n<\/p><\/div>\n

The npm security team has removed a malicious JavaScript library from the npm portal that was designed to steal sensitive files from an infected users’ browser and Discord application.<\/p>\n

The malicious package was a JavaScript library named “fallguys<\/em><\/a>” that claimed to provide an interface to the “Fall Guys: Ultimate Knockout<\/em><\/a>” game API.<\/p>\n

However, after developers downloaded the library and integrated it inside their projects, when the infected dev would run their code, the malicious package would also execute.<\/p>\n

Per the npm security team, this code would attempt to access five local files, read their content, and then post the data inside a Discord channel (as a Discord webhook<\/a>).<\/p>\n

The five files the package would attempt to read are:<\/p>\n