A recent surge of nearly 800 harmful packages has hit the npm registry, marking a new wave of malware targeting systems across Windows, Mac, and Linux platforms. This campaign, as highlighted by OpenSourceMalware researcher Paul McCarty, leverages typo-squatting on package names to deliver a potent Remote Access Trojan (RAT) and an infostealer.
Novel Approach in Malware Distribution
Unlike traditional npm software supply chain attacks that rely on lifecycle hooks like preinstall or postinstall scripts to execute malicious code, this newly uncovered threat uses a different tactic. The packages include a README file instructing developers to load them using the require() function, a method for importing modules in various environments.
Once executed, these packages initiate a downloader named WEL1DROPPER, which detects the host’s operating system and processor type. It then retrieves a suitable payload from a selection of Cloudflare Workers domains. If these HTTPS downloads fail, the malware opts for platform-specific domains, utilizing DNS TXT records to secure the next-stage payload from ‘wel1[.]ru’.
Technical Execution and Payload Delivery
Upon executing, the package requests a TXT record, parsing the response to determine the number of payload chunks. It gathers these chunks, decodes them, and transforms them into a binary buffer. The payload is then executed in a temporary directory, using either ‘/bin/sh’ on Linux and macOS or ‘cmd.exe’ on Windows.
The Windows variant takes additional steps to evade detection, such as modifying Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI). It ensures persistence through Registry Run keys and scheduled tasks, while also downloading an encrypted secondary payload. On macOS, the infection chain performs similar actions, seeking out debuggers and analysis tools before retrieving its payload.
Broader Implications and Related Threats
Sonatype, tracking this campaign as Flooding Dropper, notes that the macOS payload suggests potential targeting of Russian financial institutions. This campaign seems to evolve from the dependency confusion strategy named Moika. The development comes amidst reports from Palo Alto Networks Unit 42, which documents attacks on npm and PyPI repositories, delivering various threats like cryptocurrency stealers and cloud credential exfiltration.
Beyond npm packages, threat actors are exploiting Google Chrome extensions disguised as legitimate tools to turn browsers into web crawling proxies. These extensions use an SDK that connects browsers to third-party residential proxy networks, effectively transforming user machines into web scraping tools.
Conclusion and Future Outlook
The identification of such a vast number of malicious npm packages underscores the importance of vigilance in the software supply chain. As cyber threats continue to evolve, developers and organizations must prioritize security measures to safeguard against these sophisticated attacks. Monitoring and updating security protocols will be crucial in mitigating such risks in the future.
