Malicious Package in NPM Repository Supported Theft of User Credentials

ReversingLabs’ Director of Product Management Charlie Jones explains how the attack surface within today’s software supply chains has grown exponentially.

Looked at from one angle, the recent attack on JumpCloud, a cloud-based identity and access management provider, was unsurprising.

Threat researchers at ReversingLabs, a software supply chain security and malware analysis platform, have discovered a malicious new PyPI package dubbed VMConnect on the Python Package Index (PyPI) repository.