The npm package registry has emerged as the target of yet another highly targeted attack campaign that aims to entice developers into downloading malevolent modules.
Software supply chain security firm Phylum told The Hacker News the activity exhibits similar behaviors to that of a previous attack wave uncovered in June, which has since been linked to North Korean threat actors.
As many as nine packages have been identified as uploaded to npm between August 9 and 12, 2023. This includes: ws-paso-jssdk, pingan-vue-floating, srm-front-util, cloud-room-video, progress-player, ynf-core-loader, ynf-core-renderer, ynf-dx-scripts, and ynf-dx-webpack-plugins.
“Due to the sophisticated nature of the attack and the small number of affected packages, we suspect this is another highly targeted attack, likely with a social engineering aspect involved in order to get targets to install these packages,” the company said.
The malware then pings and waits for further instructions every 45 seconds, which are subsequently decoded and executed.
The development follows the discovery of a typosquat version of a popular Ethereum package on npm that’s engineered to make an HTTP request to a Chinese server (“wallet.cba123[.]cn” containing the user’s cryptographic key.
What’s more, the highly popular NuGet package, Moq, has drawn criticism after new versions 4.20.0 and 4.20.1 of the package released last week came with a new dependency referred to as SponsorLink that extracts SHA-256 hashes of developer email addresses from local Git configs and sends it to a cloud service without their knowledge or consent.
The controversial changes, which raise GDPR compliance issues, have been rolled back in version 4.20.2. But the damage may have been done, as Bleeping Computer reported that Amazon Web Services (AWS) has withdrawn its association with the project.
“In my opinion, the author did not intend to cause any harm but ended up damaging the trust of his users,” Checkmarx researcher Jossef Harush said. “This could have been prevented if it had been open for discussion prior to publishing the new changes and accepting the content of his users.”
The findings also come as organizations have been found increasingly vulnerable to dependency confusion attacks, potentially leading developers to unwittingly introduce vulnerable or malicious code into their projects, effectively resulting in large-scale supply chain attacks.
As mitigations against dependency confusion attacks, it’s recommended to publish internal packages under organization scopes and reserve internal package names in the public registry as placeholders to prevent misuse.
Found this article interesting? Follow us on Twitter
to read more exclusive content we post.