Malicious NPM Package Gets Downloaded 50K Times Before Discovery

Source: DevOps.com

Summary

A malicious package downloaded approximately 50,000 times from the Node package manager (npm) is providing an object lesson for adopting more DevSecOps best practices. Security researchers from Tenable discovered an “ambar‑src” package that was first published on Feb 13 and then updated again before being discovered. It is aimed at developers building JavaScript applications on Windows.