Researchers Uncover RAT-Dropping npm Package Targeting Gulp Users

Researchers discovered a malicious npm package, glup-debugger-log, that masquerades as a gulp logger and has been downloaded ~175 times. The package contains obfuscated scripts that perform environmental checks (Windows NT, network interfaces, Desktop item count) to avoid VMs, download additional malware, and establish persistence by launching an HTTP server on port 3004 to receive and execute commands, effectively providing RAT capabilities to attackers.