Two popular NPM packages with cumulative weekly downloads of nearly 22 million were found to be compromised with malicious code. The two libraries in question are "coa," a parser for command-line options, and "rc," a configuration loader. Both were tampered by an unidentified threat actor to include "identical" password-stealing malware.
Sort: