Malicious NPM Packages Deployed to Steal PayPal Credentials and Divert Crypto Transfers

Malicious actors have deployed malicious NPM packages to steal PayPal credentials and divert cryptocurrency transfers. Researchers at Fortinet have discovered several malicious NPM packages targeting PayPal users. These packages were uploaded to the repository in March by threat actors known as tommyboy_h1 and tommyboy_h2. The packages were designed to steal PayPal credentials and divert cryptocurrency transfers.