Flooding Dropper Hits npm With 850 Malicious Packages

TL;DR Sonatype Research Labs is tracking an active malicious package campaign, dubbed ‘Flooding Dropper,’ spreading on npm, currently impacting 846 software components . The attacker appears to be automating parts of the npm account and package creation process, combining terms such as bigops and bnpl with other words and recurring version patterns, such as releases in the 35.x.y range. When installed, the packages download and execute a second-stage payload, using multiple delivery methods to improve the attack’s chances of success.