Threat Actors Turn to Supply Chain Attacks to Push Malware

Arete has observed multiple campaigns of targeted supply chain attacks in which threat actors convince targets to download malware disguised as legitimate software. The tactics displayed are similar throughout the campaigns, regardless of who is launching the attack or what malware is to be downloaded.
 

Targeting Developers

Nx, an open-source platform designed to manage codebases, experienced a security incident beginning on August 26th that allowed threat actors to publish malicious versions of npm packages and other tools. When unsuspecting developers download and execute the malicious package, the malware can scan the file system, collect credentials, and then post the information to a GitHub repo under the user’s account. It is estimated that at least 1,000 GitHub tokens were leaked, with 90% remaining valid, in addition to legitimate cloud credentials and npm tokens. During these attacks, the malware was typically run on developers’ machines using the Nx Visual Studio Code extension.

Following the remediation of the first incident, there were second and third rounds of this activity by threat actors on the Nx platform, leading to the compromise of additional GitHub auth tokens, cloud-based credentials, and other stolen information that actors could use to launch ancillary attacks. To combat this activity, Nx is removing malicious npm packages as they are identified and working to fix the root cause of the incidents. Nx recommends that users who have encountered malicious repositories assume they have been compromised, stop using the malicious packages, and check for file names. zshrc and .bashrc for any evidence of unfamiliar instructions before removal of the files.
 

Targeting Crypto Users

Threat actors are distributing malware targeting crypto users through smart contracts on the Ethereum blockchain. A smart contract is a piece of code that sits on the blockchain and automatically executes once the predefined parameters are met and mined into the blockchain. Threat actors abused this native capability by disguising malware as legitimate npm packages to be downloaded by unsuspecting users and used as smart contracts. Once the package is used in a contract, the malicious script runs, executing a malicious command that contacts the threat actors’ command and control (C2) server and can then download additional malware.

What’s unique in this instance is the method of downloading the malware. Typically, malicious packages download second-stage malware by using a script already contained within the package. This gives security-minded users the chance to identify the package’s nefarious purposes by scanning for unusual URLs or commands. However, by using smart contracts to host the URLs where these malicious commands are located, threat actors can improve their odds of evading detection.
 

One Off or Here to Stay?

These are just two recent and novel examples of supply chain attacks utilizing illegitimate npm packages, and there are always new nefarious npm packages being uploaded to code repository sites like Nx and GitHub. Tricking users into downloading malicious code is a simple way to deploy second-stage malware to unknowing individuals, especially developers who may have admin access to organizations and sensitive tooling. This access allows threat actors to immediately begin ancillary actions without escalating privileges within the environment.
 

Conclusion and Remediations

Combating the use of malicious npm packages by threat actors can be difficult in organizational settings. Developers should carefully assess each library they implement before deploying it to their organization. As discussed in this article, scanning packages for threats can help identify malicious code, actor-owned C2s, or other suspicious activity, but it isn’t foolproof. Additionally, developers should view code repositories through the lens of monitoring for social engineering attacks. Threat actors can “prop up” their repositories with likes and comments from other fake accounts to bump them towards the top of the repository list. Finally, anytime suspicious activity is suspected from a downloaded npm package, security teams should delete the files and reset passwords.
 

Sources

• Ethereum smart contracts used to push malicious code on npm
• Malicious Nx Packages in ‘s1ngularity’ Attack Leaked 2,349 GitHub, Cloud, and AI Credentials
• Ethereum’s Smart Contracts Explained
• 19 npm Packages Compromised in Major Supply-Chain Attack