Dependency-confusion packages that mimic the private/internal package names of specific enterprises (Hyatt, Schedaero, Coca-Cola, Genoma and others) and beacon host and environment data to attacker-controlled collectors such as Burp Collaborator, requestcatcher and disposable inboxes.
Objective
Achieve code execution inside targeted organizations by winning the public/private package name resolution race.
Packages
- npm chrome-api-utilsattributed-to
- npm grafana-sentry-datasourceattributed-to
- npm @patternfly-v5/patternflyattributed-to
- npm electron-builder-13attributed-to
- npm graphql.vscode-graphql-syntaxattributed-to
- npm mattermost-cloudnative-bootstrapperattributed-to
- npm hyatt-residential-rosterattributed-to
- npm hyatt-albumattributed-to
- npm hyatt-avatarattributed-to
- npm @Schedaero/sharedattributed-to
- npm oc-aa-module-clientattributed-to
- npm @wame/ngx-adfsattributed-to
- npm @the-coca-cola-company/ngps-global-common-utilsattributed-to
- npm cr-static-shared-componentsattributed-to
- npm @ceeferenderer/fe-renderer-sdkattributed-to
- npm @genoma-ui/componentsattributed-to
- npm rrweb-v1attributed-to
- npm @needl-ai/commonattributed-to
- npm @flex-ng/error-componentattributed-to
- npm @flex-ng/filter-pipeattributed-to
- npm @flex-ng/header-componentattributed-to
- npm @idms-corp/auth-uiattributed-to
- npm @logdna-web/sharedattributed-to
- npm @logdna-web/stylesattributed-to
- npm tme-xcaattributed-to
- npm tme-xca-reactattributed-to
- npm tme-errorattributed-to
- npm enbd-react-loggerattributed-to
- npm enbd-react-error-boundryattributed-to
- npm enbd-react-libattributed-to
- npm box-react-uixattributed-to
- npm sams-sr-sdk-h5attributed-to
- npm chat-adapter-zoomattributed-to
- npm salesforce-vscode-sldsattributed-to
- npm slds-lsp-clientattributed-to
Indicators
- email [email protected]exfiltrates-to
- domain 64.227.183.144communicates-with
- ipv4 64.227.183.144communicates-with
- email [email protected]exfiltrates-to
- domain o4510485815754752.ingest.us.sentry.iocommunicates-with
- url https://o4510485815754752.ingest.us.sentry.io/api/4511632071262208/envelope/exfiltrates-to
- url https://o4510485815754752.ingest.us.sentry.io/api/4511630867824640/envelope/exfiltrates-to
- url https://o4510485815754752.ingest.us.sentry.io/api/4511632708141056/envelope/exfiltrates-to
- url https://o4510485815754752.ingest.us.sentry.io/api/4511630928838656/envelope/exfiltrates-to
- url https://o4510485815754752.ingest.us.sentry.io/api/4511621197856768/envelope/exfiltrates-to
- url https://o4510485815754752.ingest.us.sentry.io/api/4511675212038149/envelope/exfiltrates-to
- url https://o4510485815754752.ingest.us.sentry.io/api/4511664042999808/envelope/exfiltrates-to
- url https://o4510485815754752.ingest.us.sentry.io/api/4511709729914880/envelope/exfiltrates-to
- url https://o4510485815754752.ingest.us.sentry.io/api/4511716882972672/envelope/exfiltrates-to
Techniques
- ttp T1195.001 Compromise Software Dependencies and Development Toolsuses
- ttp T1059.007 Command and Scripting Interpreter: JavaScriptuses
- ttp T1036 Masqueradinguses
- ttp T1105 Ingress Tool Transferuses
- ttp T1071.001 Application Layer Protocol: Web Protocolsuses
- ttp T1546 Event Triggered Executionuses
- ttp T1552.001 Unsecured Credentials: Credentials In Filesuses
- ttp T1041 Exfiltration Over C2 Channeluses
- ttp T1016 System Network Configuration Discoveryuses
- ttp T1082 System Information Discoveryuses
- ttp T1102 Web Serviceuses
