@fairwords credential worm

SafeDep: three @fairwords npm packages were compromised with a
self-propagating worm that harvests credentials, crypto wallets, and
Chrome passwords. Same worm class as Shai-Hulud / ChainDrop, scoped
to that publisher.

Mapped techniques

T0121 Compromised legitimate artifact
T0169 Push implants across repositories
T0184 Harvesting sensitive information from files

supply-chain scoped worm

T0121 · Resource Development · Compromised legitimate artifact

Three @fairwords packages.

T0169 · Lateral Movement · Push implants across repositories

Self-propagating credential worm.

T0184 · Credential Access · Harvesting sensitive information from files

Wallets and Chrome passwords.

Sources

https://safedep.io/malicious-fairwords-npm-credential-worm