Hide and Fail: Obfuscated Malware, Empty Payloads, and npm Shenanigans
aikido.dev | blog | #rce | #supply-chain | #malware | #npm | #obfuscation | #aikido | #eval | #threat-analysis | #npm-malware | #fake-packages | #nodemailer
Summary
npm package node-facebook-messenger-api hid RCE logic behind axios, eval(), and an empty Google Docs payload; the same actor later shipped a fake nodemailer clone with equally conspicuous obfuscation.
- Published
- Collected
--- id: 2532 title: "Hide and Fail: Obfuscated Malware, Empty Payloads, and npm Shenanigans" source_domain: aikido.dev source_url: "https://www.aikido.dev/blog/hide-and-fail-obfuscated-malware-and-npm-shenanigan" published_at: "2025-04-03 00:00" tags: ["rce", "supply-chain", "malware", "npm", "obfuscation", "aikido", "eval", "threat-analysis", "npm-malware", "fake-packages", "nodemailer"] phying_url: "https://phying.com/item/2532" lang: en --- # Hide and Fail: Obfuscated Malware, Empty Payloads, and npm Shenanigans ## Summary npm package node-facebook-messenger-api hid RCE logic behind axios, eval(), and an empty Google Docs payload; the same actor later shipped a fake nodemailer clone with equally conspicuous obfuscation. ## Intelligence Metadata - **Sources:** aikido.dev - **Published:** 2025-04-03 00:00 - **Original:** https://www.aikido.dev/blog/hide-and-fail-obfuscated-malware-and-npm-shenanigan - **Phying News:** https://phying.com/item/2532