Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems.
Intelligence analysis by Llama
The malicious packages use AI slop squatted package names and deliver a powerful RAT and infostealer payload. The attack leads to the execution of a downloader named WEL1DROPPER, which fetches a compatible payload from a Cloudflare Workers host.
Imagine you're downloading a game on your computer, but instead of a game, you get a virus that can control your computer. This is what happened with nearly 800 malicious packages on the npm registry. These packages were designed to deliver a virus that can target Windows, Mac, and Linux systems. The virus uses a downloader to fetch a payload from a Cloudflare Workers host, which can then take control of your computer.
Analysis
Malicious npm Packages Campaign
The recent discovery of nearly 800 malicious packages on the npm registry has raised concerns about the security of open-source software. These packages, designed to deliver cross-platform malware, target Windows, Mac, and Linux systems. The campaign uses AI-generated package names, making it challenging to detect and remove the malicious code.
Attack Vector
The malicious packages use a unique attack vector, which involves loading the packages with require(), a built-in function to import modules, local files, and third-party packages. This approach allows the attackers to execute a downloader named WEL1DROPPER, which fetches a compatible payload from a Cloudflare Workers host.
Payload Delivery
The payload delivery process involves several stages, including the execution of a downloader, the identification of the host operating system and processor architecture, and the fetching of a compatible payload from a Cloudflare Workers host. The payload is then written to a temporary folder and executed using a platform-specific command.
Telemetry Implementation
The malicious packages also contain a file called 'lib/telemetry.js' that implements a plausible-looking telemetry SDK. However, this file contains the same downloader logic, making it a potential noise-generating mechanism to mask the malicious behavior.
Campaign Evolution
The recent campaign is suspected to be an evolution of a dependency confusion campaign codenamed Moika, which was observed earlier this April. The Moika campaign saw over 250 packages published to the npm registry to steal environment information and deliver an operating system-specific second-stage payload.
Threat Actor Motivation
The motivation behind this campaign is unclear, but it is suspected to be targeting Russian financial institutions and mobile payments. The presence of domains like 'tcsbank[.]ru' and 'cloudpayments[.]ru' in the macOS payload suggests a potential link to these organizations.
Security Implications
The discovery of these malicious packages highlights the importance of security in open-source software. It emphasizes the need for developers to be vigilant when using third-party packages and to regularly update their dependencies. Additionally, it underscores the importance of monitoring npm package activity to detect and prevent similar campaigns in the future.
Key points
- Nearly 800 malicious packages have been published to the npm registry as part of a new campaign designed to deliver cross-platform malware.
- The malicious packages use AI-generated package names and deliver a powerful RAT and infostealer payload.
- The attack leads to the execution of a downloader named WEL1DROPPER, which fetches a compatible payload from a Cloudflare Workers host.
- The malicious packages contain a file called 'lib/telemetry.js' that implements a plausible-looking telemetry SDK, but also contains the same downloader logic.
- The campaign is suspected to be an evolution of a dependency confusion campaign codenamed Moika, which was observed earlier this April.
If this development plays out positively, it could lead to increased security measures for open-source software, such as more robust monitoring of npm package activity and better detection of malicious code. This could help prevent similar campaigns in the future and protect developers from falling victim to these types of attacks.
The realistic downside risks or failure modes of this development include the potential for more sophisticated and targeted attacks, the possibility of increased security measures being circumvented by attackers, and the risk of widespread damage to open-source software ecosystems.
