Socket Security has spotted 10 malicious npm packages.
The thing that stands out about them is the use of a CAPTCHA challenge in the npm CLI as they're being installed, most likely as a fake-out to convince victims they're installing a legitimate and actively maintained package.
10 npm Typosquatted Packages Deploy Multi-Stage Credential H...
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer...
Socket (socket.dev)
