Today we identified two malicious package with similar payload - slf4j-api-js and concurrent-hashmap. Both are named to impersonate popular Java libraries. Lik

Today we identified two malicious package with similar payload - slf4j-api-js and concurrent-hashmap. Both are named to impersonate popular Java libraries. Likely the goal is to target Java developers looking for similar package names while building on Node/npm ecosystem. There are a few interesting notes from the malicious package: - Spawns a child process to execute embedded `main.js` which contains the actual payload - Heavy code obfuscation in `main.js` Our YARA rule based detection system was bypassed using the string obfuscation in the payload. However, our static code analysis system that looks for “code capabilities” in form of - Import a library as x (identifier) - Call a function in x This static analysis system identified potentially risky behaviour in code blocks in the obfuscated payload which was confirmed by subsequent LLM based analysis. While the sample does not appear to be sophisticated, it does seem like malicious actors are picking up obfuscation techniques from the olden Windows and Linux malware days to bypass security systems deployed to detect malicious code in open source packages.