Here’s how carefully concealed backdoor in fake AWS files escaped mainstream notice

Researchers identified two fake AWS packages in the NPM JavaScript repository that backdoored developers' computers by hiding malicious code in JPG images processed during package installation. The packages, mimicking a legitimate AWS library, downloaded hundreds of times before removal, used steganography to conceal the backdoor code. Despite the packages being flagged and removed, their availability for nearly two days highlights vulnerabilities in malware detection systems in open source software.