The OpenSSF (Open Source Security Foundation), established by the Linux Foundation and aimed at enhancing the security of open source software, has introduced the open project Package Analysis, which develops a system for analyzing the presence of malicious code in packages. The project’s code is written in Go and is distributed under the Apache 2.0 license. Preliminary scans of NPM and PyPI repositories using the proposed tooling have identified over 200 previously unnoticed malicious packages.
Most of the identified problematic packages manipulate name intersections with internal, non-public project dependencies (dependency confusion attack) or use typosquatting techniques (assigning names similar to popular libraries), as well as invoke installation scripts that reach out to external hosts. According to the developers of Package Analysis, most of the detected problematic packages were likely created by security researchers participating in bug bounty programs, as the reported data is limited to user and system names, with actions being executed explicitly without attempts to conceal their behavior.
The following packages exhibit malicious activity:
- The PyPI package discordcmd, which has been noted for sending unusual requests to raw.githubusercontent.com, the Discord API, and ipinfo.io. This package downloaded backdoor code from GitHub and installed it in the Windows client directory of Discord, subsequently launching a process to search for Discord tokens in the file system and sending them to an external Discord server controlled by the attackers.
- The NPM package colorsss, which also attempted to forward external server tokens from Discord accounts.
- The NPM package @roku-web-core/ajax — during installation, it sent system data and launched a handler (reverse shell) that accepted external connections and executed commands.
- The PyPI package secrevthree — triggered a reverse shell upon importing a specific module.
- The NPM package random-vouchercode-generator — after importing the library, it sent a request to an external server that returned a command and the time when it should be executed.
The Package Analysis work involves analyzing the source texts of code packages for establishing network connections, accessing files, and executing commands. Additionally, it tracks changes in the state of packages to determine the addition of malicious inserts in previously harmless software releases. The Package Feeds toolkit is used to monitor the emergence of new packages in repositories and make changes to previously hosted packages, unifying operations with repositories like NPM, PyPI, Go, RubyGems, Packagist, NuGet, and Crate.
Package Analysis includes three basic components that can be used together or separately:
- A scheduler that triggers package analysis jobs based on data from Package Feeds.
- An analyzer that directly checks the package and evaluates its behavior using static analysis and dynamic tracing methods. The checks are performed in an isolated environment.
- A loader that places the verification results into BigQuery storage.
Source: opennet.ru
