Attackers managed to compromise the maintainer's account and released two malicious versions of the NPM package axios, which provides an HTTP client implementation for browsers and Node.js. The axios package counts over 100 million downloads per week and is used as a dependency by 174,000 other packages. Malicious changes were integrated into the releases Axios 1.14.1 and 0.30.4 through the substitution of a fake dependency plain-crypto-js 4.2.1, which contained code to load components that accept commands from the attackers' control server. The malicious releases were available for download on March 31 for nearly 3 hours — from 03:21 to 6:15 (MSK).
The malicious versions were published to NPM directly using the credentials of the primary maintainer of the axios project ('jasonsaayman'), bypassing the standard mechanism for releasing new versions based on GitHub Actions. It is believed that the attackers managed to intercept an NPM access token from the maintainer, after which they logged into the account and changed the email binding. The specifics of how the access token was intercepted have not been clarified.
The malicious code was placed in the plain-crypto-js package in the setup.js file, triggered after the installation of the NPM package via the postinstall handler ('postinstall: "node setup.js"') and was used to download and install a trojan that affected systems running Windows, macOS, and Linux. To hide its presence after activation, the malicious component deleted the setup.js file and replaced package.json with a version without the postinstall hook. 
On macOS, the malicious executable was downloaded as '/Library/Caches/com.apple.act.mond'; on Windows — '%PROGRAMDATA%\wt.exe'; on Linux — '/tmp/ld.py,'. After activation on Linux and macOS, every 60 seconds, a command request was sent to the attackers from the infected system, which could be used to download additional malicious components, execute arbitrary shell commands, and search/send specific files. server The malicious activity on Linux and macOS did not involve persistence after reboot and was aimed at quickly collecting sensitive data, passwords, tokens, and access keys. In Windows, a file '%PROGRAMDATA%\system.bat' was created, which retrieved the malicious component from the attackers each time the system was logged into.
Вредоносная активность в Linux и macOS не предусматривала сохранение присутствия после перезагрузки и была рассчитана на быстрый сбор конфиденциальных данных, паролей, токенов и ключей доступа. В Windows создавался файл «%PROGRAMDATA%\system.bat», который извлекал вредоносный компонент с server атакующих при каждом входе в систему.
Source: opennet.ru
