CuteBoi floods npm with thousands of crypto miner packages

CuteBoi is utilizing automated NPM account creation to publish a large amount of malicious packages. Checkmarx first reported over 1,200 packages from about a thousand accounts, created with the disposable mail service mail.tm so the automation could get past npm’s 2FA challenge (also on Medium). The packages are near-copies of eazyminer, a JavaScript wrapper around XMRig, with the payout config pointed at the attacker, and the miner does not start on install, so this looks like groundwork for a later campaign. The CuteBoi Tracker (checkmarx/cuteboi) now lists 2532 packages that mostly utilize XMRig miners. Checkmarx told The Register that CuteBoi is the second group this year, after Red-Lili, to automate large-scale attacks on npm. Two-factor authentication is only as strong as the mailbox behind it, and mail.tm hands those out over a REST API.