Threats Tagged 'node-fetch-core'

A malicious npm package named 'node-fetch-utils' was identified masquerading as a legitimate utility. It uses a remote tarball dependency from GitHub that executes during installation on Windows systems. The package runs an obfuscated postinstall script that downloads a bundled Python runtime, placing it as Microsoft\EdgeBroker\pythonw.exe for persistence. This runtime is then used to execute a fileless Python implant decrypted in memory and launched stealthily via wscript. The dropper scripts self-delete while the disguised runtime remains active, establishing command and control communications.