A malicious npm package that has been downloaded millions of times comes with a new way of spreading the malware that makes it easier to bypass security protections, say researchers with security vendor Checkmarx.
Rather than using more common preinstall or postinstall scripts, the bad actors instead created a malicious package – indexed-btree – that mimics the legitimate sorted-btree package and hides the malware in the package’s runtime code, according to Checkmarx security researcher Bruno Dias.
Indexed-btree “runs entirely from application code at runtime,” Dias wrote in a report. “Additionally, this package achieved almost 2 million weekly downloads, which shows not much has changed in the npm ecosystem despite the limitations put on lifecycle scripts.”
The latest malware targeting npm packages hides inside the Btree.prototype.set, the standard method in JavaScript B-Tree data structures. Because there’s no install hook inside the package.json file, installing the package does not launch any malicious activity. However, using the package can trigger the JavaScript code that includes the malware’s first stage.
The malicious package includes a heavily obfuscated file that includes a range of tasks, including fingerprinting and exfiltrating such host information as the operating system architecture, hostname, the CPU, and memory, which are then sent to a hardcoded Slack channel and Telegram chat.
It also uses an Ethereum smart contract on Sepolia testnet – a proof-of-stake (PoS) testnet that developers use to deploy and test smart contracts – as its command-and-control (C2) channel. The testnet “exposes getter and setter functions that the malware polls instead of requesting a plain domain,” Dias wrote, adding that the technique “is more resilient to domain [or] IP takedown than traditional C2 approaches, since it uses the smart contract as a pointer to a new address whenever the old one gets taken down.”
The malicious code includes the ability to delete its malware files and remove the trigger code to erase its traces.
Attacker Creates a GitHub Repository
Along with the decision to hide the malicious code by mimicking a legitimate package, the attacker also includes a seemingly legitimate GitHub repository that comes with realistic commits and an account. As of late last week, the repository was still up and the attack was ongoing, according to Checkmarx.
“A GitHub repository is something that attackers don’t usually bother creating,” Dias wrote. “This one is clever enough to not include the malicious code. Additionally, the presence of many commits can aid in making it look like a legit repository.”
In addition, while there is not much in the account in terms of activity or an in-depth bio, it does include an AI-generated photo, which is another way of giving the repository an air of legitimacy.
Checkmarx estimates that the bad actor was able to collect 109 ETH, or about $264,963.
Adapting to Defenses
“What makes this campaign particularly important is that it shows attackers adapting almost immediately to stronger software supply chain defenses,” SOCRadar CISO Ensar Seker said. “npm has improved install time security by restricting dependency lifecycle scripts, but this campaign demonstrates that attackers can simply move malicious execution into legitimate looking runtime functionality instead.”
A clean installation no longer leads to a clean dependency, Seker said, adding that software supply chain security now needs to extend beyond the reputation of a package and installation-time scanning. Defenders need to look at such areas as dependency provenance, unexpected code changes, runtime behavior, and outbound network connections.
“The broader lesson is that security controls change attacker behavior rather than eliminate the underlying threat,” he said.
