Cybersecurity researchers at Socket have discovered a malicious npm package, @naderabdi/merchant-advcash, that hijacks server control during payment transactions. The package, designed to look like a legitimate integration for the Advcash payment platform, activates a reverse shell upon successful payment, allowing attackers to remotely control systems. The sophistication of the module, including its delayed activation and minimal footprint, helps it evade static analysis tools. Developers are reminded to be cautious and not blindly trust external packages.
43 Impressions