Sam Stepanyan :verified: 🐘<p><a href="https://infosec.exchange/tags/NPM" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NPM</span></a>: Two malicious packages were discovered on npm (<a href="https://infosec.exchange/tags/NodeJS" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>NodeJS</span></a> package manager) that covertly patch legitimate, locally installed packages to inject a persistent reverse shell backdoor:<br><a href="https://infosec.exchange/tags/SoftwareSupplyChainSecurity" class="mention hashtag" rel="nofollow noopener" target="_blank">#<span>SoftwareSupplyChainSecurity</span></a><br>👇<br><a href="https://www.bleepingcomputer.com/news/security/new-npm-attack-poisons-local-packages-with-backdoors/" rel="nofollow noopener" translate="no" target="_blank"><span class="invisible">https://www.</span><span class="ellipsis">bleepingcomputer.com/news/secu</span><span class="invisible">rity/new-npm-attack-poisons-local-packages-with-backdoors/</span></a></p>