Malicious code in apple-internal-pki-trust (npm)
Malicious npm package published by threat actor "raya4321" as part of a coordinated typosquatting campaign impersonating Apple internal infrastructure services (authentication, PKI, telemetry, CloudKit, and cloud infrastructure). All packages in this campaign execute credential-theft payloads during npm installation via preinstall or postinstall lifecycle hooks.
Trigger: preinstall. Exfiltrates Azure access tokens (/.azure/accessTokens.json), git credentials (/.git-credentials), and .env files from the home directory, base64-encoded, to https://franki.requestcatcher.com/apple_pre via curl.
-= Per source details. Do not edit below this line.=-
The package apple-internal-pki-trust was found to contain malicious code.
왜 이 VPI인가 (설명가능 · 실험적)
VPI 산정 기준
| 영향도(기본값(정보 없음)) | 55.00 |
| 악용 신호(추가 악용신호 없음) | ×1.00 |
| VPI | 55.00 |
VPI 공식 vpi-v1 기준