The 50,000-Download Trap: How ‘ambar-src’ Typosquatting Compromised Windows, Linux, and macOS Devs

Tenable Research discovered a malicious npm package, "ambar-src," that used typosquatting against the popular "ember-source" package to distribute cross-platform malware via npm's preinstall hook; the package amassed ~50,000 downloads before removal and delivers Windows (msinit.exe with encrypted shellcode), Linux (ELF 'osa' reverse SSH client), and macOS (Apfell) payloads, using legitimate cloud services for C2 and recommending that any affected systems be treated as fully compromised.