One In Two New Npm Packages Is SEO Spam Right Now

[Wilson Grant Fisk]

More than half of all new packages that are currently (29 Mar 2023) being submitted to npm are SEO spam. That is - empty packages, with just a single README file that contains links to various malicious websites.
Out of the ~320k new npm packages or versions that Sandworm has scanned over the past week, at least ~185k were labeled as SEO spam. Just in the last hour as of writing this article, 1583 new e-book spam packages have been published.


All the identified spam packages are currently live on npmjs.com.

Interesting read - source: https://blog.sandworm.dev/one-in-two-new-npm-packages-is-seo-spam-right-now

 

[Steptoe]

Lol that's pretty bad. I knew the 'movies online' guys liked that parasite (along with loads of other repository-type sites, gitlabs etc) but with that much spam coming through the doors you'd think the site admins would have noticed and started hardening security or bot detection.

 

[Curious Ed]

Better than the malware that npm used to be known for.

 

[Floch]

those guys are spamming those sites for a year or two I think, here is the old news https://medium.com/checkmarx-security/illustria-checkmarx-finds-140k-phishing-packages-6813c27d10ac nuget patched it by not indexing the package to google (I think so maybe I am wrong).

and @Steptoe can you please shed some light here on these links on how they do it its not a pdffile.

https://timplodge.byu.edu/m1hs

 

[Steptoe]

and @Steptoe can you please shed some light here on these links on how they do it its not a pdffile.

https://timplodge.byu.edu/m1hs

Looks to me like some sort of vulnerability being exploited, either in the booking form or the CMS used (Brightspot), or a webshell sneaked on there somehow. Judging from the pages indexed it's just one guy/group that has access.

 

[Epicster]

Looks to me like some sort of vulnerability being exploited, either in the booking form or the CMS used (Brightspot), or a webshell sneaked on there somehow. Judging from the pages indexed it's just one guy/group that has access.

Here's another one:

http://about.bcse.org/video/watch.php?vid=video-lkw.292.html?rek

The cool thing it just redirects to the target page.

 

[Floch]

Here's another one:

http://about.bcse.org/video/watch.php?vid=video-lkw.292.html?rek

The cool thing it just redirects to the target page.

Yo, that's cool how do they do that?

 

[Epicster]

I think it's some sort of an Exploit because it redirects.