Malicious npm package steals Discord token & user credit card info

Malicious npm package steals Discord token and user credit card or other payment information

By the way, our today’s topic is that malicious npm package steals Discord token and user credit card or other payment information but before start the topic firstly we should know that what is npm package? so please take a short look – In JavaScript npm (Node Package Manager) occupies a special place because it is also the default package manager of the Java language, programmed by Isaac Z. Schlueter. Let me tell you that it allows users to consume and distribute every type of JavaScript module available in the registry at will.

Hopefully you must have understood that what is npm and what is its use and how important it is in Java language, but did you know that the more useful a lossless npm is, the more malicious npm package becomes a bigger problem for its users. So let’s go on telling people that nowadays some who want to become rich very quickly by misusing their knowledge, in other words we can also call them hackers, they first infect the npm package with malware and make them malicious npm package and then use them to steal users’ Discord tokens and user credit card or other payment information.

Leonid Bezvarshenko and Igor Kuznetsov, the researchers of Kaspersky, a well-known Internet Security company, according to them, such attack has been an attack of malware named Lofi Stealer and it is an open-source and Python-based Volt Stealer token logger and nasty Javascript malware. The Researchers reported that on July 26 they identified 4 suspicious npm packages that were using an internal automated system to monitor open-source repositories.

They also pointed out that they contained not only JavaScript code but also obscure malicious Python code and he named the malicious campaign ‘Laughylife’. The worst part is that once a malicious npm module installs pern-valids, proc-title, small-sm or lifeculer, then the malware is automatically deployed after that.

Just once this Volt Stealer version is installed then it very easily starts collecting and stealing all the data of the victims especially it collects the Discord token and system information of the victims as well as their Collects account information and IP address and steals them.