The npm package registry has emerged as the target of yet another highly targeted attack campaign that aims to entice developers into downloading malevolent modules.
Software supply chain security firm Phylum told The Hacker News the activity exhibits similar behaviors to that of a previous attack wave uncovered in June, which has since been linked to North Korean threat actors.
The attack chain commences with the package.json file with a postinstall hook that executes an index.js file upon package installation. The latter uses the legitimate pm2 module as a dependency to launch a daemon process that, in turn, executes another JavaScript file named app.js.
The JavaScript code is designed to initiate encrypted two-way communication with a remote server – “ql.rustdesk[.]net,” a spoofed domain masquerading as the legitimate RustDesk remote desktop software – 45 seconds after the package is installed and transmit basic information about the compromised host.
The development follows the discovery of a typosquat version of a popular Ethereum package on npm that’s engineered to make an HTTP request to a Chinese server (“wallet.cba123[.]cn” containing the user’s cryptographic key.
What’s more, the highly popular NuGet package, Moq, has drawn criticism after new versions 4.20.0 and 4.20.1 of the package released last week came with a new dependency referred to as SponsorLink that extracts SHA-256 hashes of developer email addresses from local Git configs and sends it to a cloud service without their knowledge or consent.
The findings also come as organizations have been found increasingly vulnerable to dependency confusion attacks, potentially leading developers to unwittingly introduce vulnerable or malicious code into their projects, effectively resulting in large-scale supply chain attacks.
As mitigations against dependency confusion attacks, it’s recommended to publish internal packages under organization scopes and reserve internal package names in the public registry as placeholders to prevent misuse.
Source: https://thehackernews.com/
