ReversingLabs discovered a typosquatting attack on NPM packages, which they dubbed IconBurst. The initial indicator was the usage of a javascript obfuscator. Based on this, more than two dozen NPM packages with a common naming pattern were discovered, e.g., icons-package, icons-pack, icon-package, icons-packages, … . After the installation a respective typo-squatted domain was utilized for data exfiltration. The malicious packages have been collectively downloaded more than 27,000 times. Malwarebytes points out that the real victims are the people filling in forms on the developers’ sites, and that some of the packages were still available for download at the time of writing.
