Flutterby™! : Backdooring an AWS utility

Here’s how carefully concealed backdoor in fake AWS files escaped mainstream notice

Files available on the open source NPM repository underscore a growing sophistication.

Including a piece of JavaScript code that nominally calculated an average brightness for a .JPG file, but extracted code embedded in the JPEG to run. One of the JPEGs included (interestingly, not the one that JPEG loading code reported as corrupt) code to hit a C&C HTTP server for further instructions...