The attack event targeting the NPM Supply Chain has occurred again, with @ctrl/tinycolor releasing a malicious version.

PANews reported on September 16 that Scam Sniffer has detected another attack targeting the NPM Supply Chain. A malicious version of @ctrl/tinycolor (which has a weekly download of 2.2 million times) was released, which runs an information-stealing program during the npm postinstall script execution to scan and steal sensitive data. This malicious payload abused the legitimate sensitive information scanning tool TruffleHog. Please check if you have downloaded the affected version, pause installation/updates, and pin the version to a known safe version.
Disclaimer: The information on this page may come from third-party sources and is for reference only. It does not represent the views or opinions of Gate and does not constitute any financial, investment, or legal advice. Virtual asset trading involves high risk. Please do not rely solely on the information on this page when making decisions. For details, see the Disclaimer.
Comment
0/400
No comments