A recently observed malicious campaign has relied on typosquatting to trick users into downloading a malicious NPM package that would infect their systems with a rootkit, supply chain security firm ReversingLabs warns.
The malicious package, named ‘node-hide-console-windows’, which was designed to mimic the legitimate ‘node-hide-console-window’ package on the NPM repository, first appeared at the end of August, but amassed more than 700 downloads before being removed.
To ensure that the malicious package was hard to distinguish from the legitimate one, the threat actor not only mimicked the package name, but also the repository contents, publishing ten versions of the code, the same as for the real ‘node-hide-console-window’.
Upon execution, the malicious code would fetch an executable from a remote location, which turned out to be a copy of DiscordRAT 2.0, an open source remote access trojan (RAT), which claims to have been created ‘for educational use only’.
Once set up, DiscordRAT creates a channel in the associated Discord server, then waits for additional commands from its operator. The RAT can exfiltrate information from the infected system, can disable security programs, kill processes, prevent the use of mouse and keyboard, and even shut down the system.
ReversingLabs’ analysis of the malware variant used in this attack also revealed the inclusion of support for a new command that allowed the threat actor to launch an older version of the r77 rootkit on the victim’s system.
An open source malware, r77 is easy to deploy, can be bundled with other software, and can hide its presence on the system, via two registry subkeys (one for the executable path and another for the malware’s process).
According to ReversingLabs, all ten versions of the malicious package downloaded the same executable delivering DiscordRAT 2.0, which in turn could execute the r77 rootkit. The RAT also included a command to remove the rootkit.
The most recent two versions of the malicious package also contained code to fetch a PyInstaller-compiled executable serving the Blank-Grabber information stealer.
The malicious ‘node-hide-console-windows’ package has been removed from the NPM repository.
The threat to open source developers
Despite the threat actor’s efforts to make the malicious package seem trustworthy, the campaign does not show signs of sophistication, especially given the use of open source malware that could be easily detected, but the threat it poses should not be underestimated.
“Regardless of how this campaign ranks in sophistication, these packages highlight an always present, and growing, danger lurking on public repositories such as NPM or PyPI, as well as on GitHub. Something as dangerous and invasive as a rootkit is easily available to everyone, well documented, and ready for use,” ReversingLabs notes.
According to Bugcrowd director of cybersecurity Sajeeb Lohani, this attack underlines the risks developers expose themselves to when placing trust in open source packages without thoroughly verifying them first.
“Installing any software package from a majority of the package managers, basically runs the code written by the author. This puts a large amount of trust on package developers, which can be abused, allowing the threat actor to compromise any system that downloads and installs the package,” Lohani said in an emailed comment.
Keeper Security head of product Zane Bond, points out that this campaign shows once again the increasing interest of threat actors in open source environments, which allows them to set up impactful supply chain attacks.
“Open-source packages are the underpinnings of many enterprise software systems that are distributed globally, and is one reason supply chain security has become a priority in recent years. Cybersecurity technologies protecting these environments must cover every user, on every device, from every location,” Bond said.
Developers who downloaded the malicious package and were infected with the r77 rootkit, Lohani says, should re-install their systems, to remove any malware.
“Since r77 is a fileless rootkit, and the framework may have been modified prior to deployment, it is often safer to re-image the affected device, following disaster recovery protocols. I strongly recommend having proper logs sent to immutable log storage services, which helps a blue team to search and identify potentially affected systems,” Lohani said.
Additionally, Netenrich principal threat hunter John Bambenek underlines, it is critically important to maintain visibility into all dependencies used within a development environment, to remedy any attack efficiently.
“Teams need to keep a strong and accurate library of what packages are installed so they can quickly go back and remove libraries that have been compromised or malicious typosquatted libraries, as that is a manual process,” Bambenek commented.
Related: Dozens of Malicious NPM Packages Steal User, System Data
Related: Developers Warned of Malicious PyPI, NPM, Ruby Packages Targeting Macs
Related: Malicious NuGet Packages Used to Target .NET Developers
