Microsoft Azure developers targeted with flood of malicious npm packages

A finger pressing a padlock icon
(Image credit: Shutterstock)

More than 200 malicious npm packages were recently removed from the npm registry, security experts have confirmed.

The goal of the packages was to steal personally identifiable information (PII) from the endpoints of Microsoft Azure developers.

As per a report from The Register, security firm JFrog’s automated analysis of the repository started raising alarms about suspicious uploads earlier this week. Manual inspection has since uncovered a group of more than 200 packages, all of which were essentially malware.

TechRadar needs you!

We're looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn't take more than 60 seconds of your time. Thank you for taking part.

>> Click here to start the survey in a new window <<

"After manually inspecting some of these packages, it became apparent that this was a targeted attack against the entire @azure npm scope, by an attacker that employed an automatic script to create accounts and upload malicious packages that cover the entirety of that scope," security researchers Andrey Polkovnychenko and Shachar Menashe said in their analysis of the incident.

Fooling people

In an attempt to trick the developers, the attackers gave the malicious packages the same name as their non-malicious counterparts, with the @azure scope identifier missing.

"The attacker is relying on the fact that some developers may erroneously omit the @azure prefix when installing a package," the researchers explained. "For example, running npm install core-tracing by mistake, instead of the correct command – npm install @azure/core-tracing."

But that’s not the only way the attackers tried to fool people into downloading these malicious packages. They also added high version numbers hoping that internal npm private proxies search for newer versions of packages first.

Finally, the attackers uploaded the packages via an automated script that created a unique username for each upload, probably in hopes of avoiding common detection methods.

In total, 218 malicious packages were uploaded and were in place for two days. During that time, they were downloaded an average of 50 times each, totalling roughly 10,000 potential victims.

Via The Register

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.

Read more
Pirate skull cyber attack digital technology flag cyber on on computer CPU in background. Darknet and cybercrime banner cyberattack and espionage concept illustration.
Microsoft reveals over a million PCs hit by malvertising campaign
hacker.jpeg
VSCode extensions pulled over security risks, but millions of users have already installed
An abstract image of digital security.
Hundreds of GitHub repositories hijacked to trick users into downloading malware
GitHub Webpage
A cracked malicious version of a Go package lay undetected online for years
A graphic showing someone on a tablet working through a supply chain.
Security issue in open source software leaves businesses concerned for systems
chrome firefox extensions
Google Chrome extensions hit in major attack - dozens of developers affected, so be on your guard
Latest in Security
Data leak
Top home hardware firm data leak could see millions of customers affected
Representational image depecting cybersecurity protection
Third-party security issues could be the biggest threat facing your business
A stylized depiction of a padlocked WiFi symbol sitting in the centre of an interlocking vault.
Broadcom warns of worrying security flaws affecting VMware tools
Android Logo
Devious new Android malware uses a Microsoft tool to avoid being spotted
URL phishing
HaveIBeenPwned owner suffers phishing attack that stole his Mailchimp mailing list
Ransomware
Cl0p resurgence drives ransomware attacks to new highs in 2025
Latest in News
Buzz Lightyear Space Ranger Spin Rennovations
Disney’s giving a classic Buzz Lightyear ride a tech overhaul – here's everything you need to know
Hisense U8 series TV on wall in living room
Hisense announces 2025 mini-LED TV lineup, with screen sizes up to 100 inches – and a surprising smart TV switch
Nintendo Music teaser art
Nintendo Music expands its library with songs from Kirby and the Forgotten Land and Tetris
Opera AI Tabs
Opera's new AI feature brings order to your browser tab chaos
An image of Pro-Ject&#039;s Flatten it closed and opened
Pro-Ject’s new vinyl flattener will fix any warped LPs you inadvertently buy on Record Store Day
The iPhone 16 Pro on a grey background
iPhone 17 Pro tipped to get 8K video recording – but I want these 3 video features instead