ReversingLabs researchers revealed Thursday that two malicious packages lived on npm for two months before being detected. “The presence of such suspicious characteristics and behaviors first caused the npm package nodejs-encrypt-agent to come to our attention,” wrote Lucija Valentić, a software threat researcher at ReversingLabs.

Read full article on The New Stack