Ghost campaign spreads via npm modules and GitHub to harvest crypto wallets and credentials
Cybersecurity analysts have identified a cluster of hostile npm libraries that aim to exfiltrate cryptocurrency wallets and other sensitive credentials. ReversingLabs is tracking this activity as the “Ghost” campaign. The malicious packages all originate from a user account named “mikilanjillo” and include the following modules:
- react-performance-suite
- react-state-optimizer-core
- react-fast-utilsa
- ai-fast-auto-trader
- pkgnewfefame1
- carbon-mac-copy-cloner
- coinbase-desktop-sdk
According to ReversingLabs, the libraries try to trick developers into revealing their administrator password and conceal their true behavior by simulating a normal install process. The packages produce fake installation output, pause for random intervals to mimic legitimate download activity, and then present an apparent error about lacking write permissions to /usr/local/lib/node_modules, which is the typical global Node.js install path on macOS and Linux.
At that stage the malicious installer prompts the user to supply a root or admin password to proceed. If a victim complies, the supplied credentials allow the installer to quietly retrieve a secondary downloader. That component then queries a Telegram channel to obtain the URL for the final payload and the decryption key needed to unlock it.
The chain concludes with the deployment of a remote access trojan capable of gathering stored credentials, targeting cryptocurrency wallets, and awaiting additional commands from a remote server.