An attack on users of the NPM directory has been recorded, resulting in over 15,000 packages being posted to the NPM repository on February 20, with README files containing links to phishing sites or referral links that offer commissions for clicks. Analysis revealed 190 unique phishing or advertising links covering 31 domains within the packages.
Package names were chosen to attract the attention of the average user, such as 'free-tiktok-followers', 'free-xbox-codes', 'instagram-followers-free', and so on. The intent was to fill the recent updates list on the NPM homepage with spammy packages. Package descriptions contained links promising free giveaways, gifts, game cheats, as well as free services for boosting followers and likes on social media platforms like TikTok and Instagram. This is not the first attack of this kind; in December, a publication of 144,000 spam packages was recorded in the NuGet, NPM, and PyPi catalogs.
The content of the packages was generated automatically using a Python script that, apparently due to oversight, was left in the packages and included working credentials used during the attack. The packages were published under numerous different accounts using methods that complicated the tracing of the source and the quick identification of problematic packages.
In addition to fraudulent activities, several attempts to publish malicious packages have also been detected in the NPM and PyPi repositories:
- The PyPI repository has found 451 malicious packages that disguised themselves as popular libraries using typosquatting (assigning similar names differing by individual characters, e.g., vper instead of vyper, bitcoinnlib instead of bitcoinlib, ccryptofeed instead of cryptofeed, ccxtt instead of ccxt, cryptocommpare instead of cryptocompare, seleium instead of selenium, pinstaller instead of pyinstaller, etc.). The packages included obfuscated code for stealing cryptocurrency, which identified the presence of cryptocurrency wallet IDs in the clipboard and replaced them with the attacker’s wallet (it is assumed that the victim would not notice that the wallet number being transferred through the clipboard was different when making a payment). The replacement was carried out by a browser extension embedded in the context of each viewed web page.
- A series of malicious HTTP libraries have been identified in the PyPI repository. Malicious activity was found in 41 packages, whose names were chosen using typosquatting methods and resembled popular libraries (aio5, requestst, ulrlib, urllb, libhttps, piphttps, httpxv2, etc.). The content was styled to look like working HTTP libraries or copied the code of existing libraries, and the description included claims of advantages and comparisons with legitimate HTTP libraries. The malicious activity was either aimed at downloading malware to the system or collecting and sending confidential data.
- 16 JavaScript packages (speedte*, trova*, lagra) have been identified in NPM that, in addition to their declared functionality (bandwidth testing), also contained code for mining cryptocurrency without the user’s knowledge.
- 691 malicious packages have been identified in NPM. Most of the problematic packages pretended to be Yandex projects (yandex-logger-sentry, yandex-logger-qloud, yandex-sendsms, etc.) and included code for sending confidential information to external sources. serversIt is believed that the package uploaders attempted to achieve substitution of their own dependencies during Yandex project builds (a method of substituting internal dependencies). In the PyPI repository, the same researchers found 49 packages (reqsystem, httpxfaster, aio6, gorilla2, httpsos, pohttp, etc.) with obfuscated malicious code that downloads and executes a file from external sources. server.
Source: opennet.ru
