The NPM ecosystem is facing a significant cybersecurity threat following the discovery of a malicious package that has been downloaded millions of times. According to a report by Checkmarx, the threat actor behind this attack has skillfully evaded recent NPM security measures by embedding a malicious trigger within the package’s JavaScript prototype code.
Innovative Evasion Tactics
Unlike typical attacks that aim for quick spread through high-profile packages, this malicious campaign strategically bypassed detection. The attacker gained trust by setting up a seemingly legitimate GitHub repository, which contributed to the package’s widespread adoption.
The package in question, named indexed-btree, mimics a legitimate tool called sorted-btree. Before detection, it achieved a staggering 2 million downloads weekly, as reported by Checkmarx. The GitHub account supporting this package featured numerous authentic-looking commits, further masking its malicious intent.
Technical Intricacies of the Attack
The hidden threat was embedded in the library’s core functionality, specifically within the BTree.prototype.set method. Upon execution, the embedded malware collected system data and communicated with a hardcoded Slack channel and Telegram chat. It also interacted with a blockchain contract on Sepolia, which served as its command-and-control (C&C) hub, facilitating further malicious activities.
In a previous incident, the attacker’s smart contract surfaced in the mutex-forge package. Overall, the threat actor’s activities have reportedly amassed 109 ETH, equivalent to nearly $300,000.
Wider Implications and Future Outlook
The indexed-btree package is not an isolated case. Other packages linked to this campaign, such as ordered-kv-index and btree-leaderboard, collectively amassed over 5 million downloads before being withdrawn. This ongoing threat poses a dynamic risk to organizations, featuring resilient C&C tactics and deeply concealed malicious code.
Checkmarx warns that such sophisticated attacks underline the necessity for enhanced vigilance and security measures within the software supply chain. As these threats evolve, organizations must prioritize robust security practices to mitigate potential impacts.
Related news highlights similar threats in software supply chains, including targeted attacks on Rust team members and a significant breach affecting 100,000 websites. These incidents collectively emphasize the growing sophistication and scope of supply chain attacks.
