For the past four months, over 130 malicious NPM packages deploying information stealers have been collectively downloaded roughly 100,000 times, security researchers warn. A total of 136 NPM packages engaging in the malicious behavior have been identified, as part of two different operations that have been active since July and August, respectively. Only 10 packages were identified as part of the campaign that started in July, but they accumulated more than 9,900 downloads collectively by the time cybersecurity firm Socket found them. The packages rely on NPM’s postinstall hook for the automatic execution of a script when npm install is run. The script identifies the victim’s operating system and launches a payload in a new terminal window, to run independently of the NPM install…