3a-spawn

3a-spawn is a malicious package. This instance of the 3a-spawn package contains malware and attempts to compromise users by adopting dependency confusion techniques. A dependency confusion attack is a type of supply chain attack where malicious software is inserted into the development process by replacing a legitimate software package with a malicious one. Users are exposed if they've installed the 3a-spawn package from public repositories. Installations of this package from private repositories or CDNs are likely safe to use. This package is part of an Open Source Supply Chain Attack campaign conducted by the Lazarus Group. The threat actors initiated the attack chain by impersonating developers and recruiters to target employees of technology firms, focused on individuals associated with the blockchain, cryptocurrency, and online gambling sectors. The threat actors would establish initial contact through fake persona accounts on platforms such as LinkedIn, Slack, and Telegram, and on establishing a rapport with the targets, usually shifting communication to a different platform. Once contact was established, the attacker would invite the target to collaborate on a GitHub repository, containing malicious npm package dependencies which would then be used to compromise the victim. cryptopriceoffer[.]com npmjscloud[.]com npmrepos[.]com tradingprice[.]net npmjsregister[.]com npmcloudjs[.]com bi2price[.]com npmaudit[.]com coingeckoprice[.]com Avoid using all malicious instances of the package.