NPM Package Hidden QR Codes to Steal Credentials
Source: npm Package Uses QR Code Steganography to Steal Credentials (2025-09-24)
A malicious npm package has been discovered using QR code steganography to secretly steal user credentials. The technique involves embedding hidden QR codes within images or files, making it difficult to detect malicious activity. Cybersecurity experts warn that this method could enable attackers to bypass traditional security measures. Users are advised to exercise caution when installing npm packages and verify their sources to prevent potential breaches.