Ghost Campaign is a new and sophisticated threat targeting developers via malicious npm packages, with the aim of stealing cryptocurrencies and sensitive data. Cybersecurity researchers from ReversingLabs have identified seven packages published by user mikilanjillothat use advanced social engineering techniques to gain access to victim systems.
See also: North Koreans published 26 malicious npm packages for RAT distribution
The malicious packages detected include react-performance-suite , react-state-optimizer-core , carbon-mac-copy-cloner , and coinbase-desktop-sdk . These Node.js libraries are presented as legitimate development tools, but in reality they perform sophisticated phishing attacks to obtain sudo passwords from users.
According to Lucija Valentić, a software threat researcher at ReversingLabs, the Ghost Campaign uses highly sophisticated obfuscation techniques. The packages display fake npm to give the impression that the installation process is proceeding normally, while simultaneously performing malicious actions in the background.
Technical details of the Ghost Campaign attack
The attack begins when malicious npm packages pretend to download additional packages and introduce random delays to give the impression of a normal installation process. At some point, the system notifies the user that the installation encountered an error due to lack of write permissions to /usr/local/lib/node_modules , which is the default location for globally installed Node.js packages on Linux and macOS systems .
The malware instructs the victim to enter the root or administrator password to continue the installation. If the password is entered, the malware silently retrieves the next-stage downloader, which then connects to a Telegram to obtain the URL for the final payload and the key required to decrypt it.
See also: XMRig Wormable Campaign: New attack with BYOVD exploit
The attack culminates in the deployment of a remote access trojan capable of collecting data, targeting cryptocurrency wallets, and waiting for further instructions from an external server. This multi-stage approach makes detection extremely difficult, as each stage appears legitimate until the final payload is activated.
Connections to other campaigns and GhostClaw
ReversingLabs notes that this activity overlaps with a group documented by JFrog earlier this month called GhostClaw . However, it is unclear whether this is the work of the same threat actor or a completely new campaign. GhostClaw uses GitHub repositories and AI-assisted development workflows to deliver credential-stealing payloads to macOS .
Protection and security recommendations
To protect against such threats, experts recommend using dependency scanning tools like Socket, Endor Labs , or JFrog to detect risks in the npm. It is also critical to avoid using sudo npm and review preinstall and postinstall before installing packages.
See also: Lazarus campaign plants malicious npm and PyPI packages
Organizations should monitor registries for malicious releases, revoke compromised tokens, and use private .npmrc where possible. Isolating builds in ephemeral CI can also limit the impact of such attacks, according to the source.
