A baker’s dozen of packages hosted on the NuGet repository for .NET software developers are actually malicious Trojan components that will compromise the installation system and download crypto-stealing malware with backdoor functionality. Software supply chain security firm JFrog stated in an analysis published March 21 that the 13 packages, which have since been removed, have been downloaded more than 166,000 times and impersonate other legitimate software, such as Coinbase and Microsoft ASP.NET.

Read full article on Dark Reading: Cloud