A newly discovered malicious NPM package targeting Node.js SMTP servers has been found stealing sensitive credentials from developers and organizations. This package, disguised as a legitimate utility, infiltrates development environments by exploiting the widespread use of Node.js and its package manager, NPM. Once installed, it silently captures SMTP credentials, enabling attackers to intercept emails and potentially launch further attacks such as phishing or data exfiltration. The incident highlights the growing threat of supply chain attacks in the software development ecosystem, emphasizing the need for rigorous package vetting and security practices. Developers are urged to audit their dependencies regularly and use trusted sources to mitigate risks. This attack underscores the importance of securing development pipelines and monitoring for unusual network activities to prevent credential theft and maintain organizational security integrity.
This Cyber News was published on thehackernews.com. Publication date: Tue, 02 Sep 2025 22:14:04 +0000