New Ghost Campaign Uses Fake npm Progress Bars to Phish Sudo Passwords

Researchers identified the 'Ghost' campaign—malicious npm packages (published by handle 'mikilanjillo' and including names like react-state-optimizer-core and coinbase-desktop-sdk) that display fake install logs and progress bars to phish sudo passwords, deploy a RAT, and exfiltrate cryptocurrency wallets and sensitive files; multiple package versions and a subsequent similar package found by JFrog suggest broader supply-chain abuse.