ReversingLabs analysis results of the application in the RubyGems repository. Typesquatting is typically used to distribute malicious packages, relying on the inattentive developer to make a typo or overlook the difference when searching. The research identified more than 700 packages whose names closely resemble popular ones, differing only in minor details, such as replacing similar letters or using underscores instead of hyphens.
More than 400 packages were found to contain components suspected of malicious actions. In particular, there was a file named aaa.png that included executable code in PE format. The identified packages were associated with two accounts that uploaded , which were collectively downloaded around 95,000 times. Researchers informed the RubyGems administration, and the identified malicious packages have already been removed from the repository.
Of the identified problematic packages, the most popular was ‘atlas-client’, which at first glance is nearly indistinguishable from the legitimate package ‘’. This package was downloaded 2,100 times (while the legitimate package was downloaded 6,496 times, meaning users were wrong nearly 25% of the time). The remaining packages were, on average, downloaded 100-150 times and camouflaged as other packages using similar techniques of replacing underscores and hyphens (for example, among : appium-lib, action-mailer_cache_delivery, activemodel_validators, asciidoctor_bibliography, assets-pipeline, apress_validators, ar_octopus-replication-tracking, aliyun-open_search, aliyun-mns, ab_split, apns-polite).
The malicious packages included a PNG file that contained an executable file for the Windows platform instead of an image. The file was created using the Ocra Ruby2Exe utility and included a self-extracting archive with a Ruby script and Ruby interpreter. When the package was installed, the png file was renamed to exe and executed. During execution, a file with VBScript was created and added to the startup. The specified malicious VBScript continuously analyzed the contents of the clipboard for information resembling cryptocurrency wallet addresses and, upon detection, replaced the wallet number, anticipating that the user would not notice the difference and would transfer funds to the wrong wallet.
The conducted research showed that it is not difficult to add malicious packages to one of the most popular repositories, and these packages can remain unnoticed despite a significant number of downloads. It should be noted that the issue to RubyGems and concerns other popular repositories. For example, last year the same researchers discovered a malicious package called bb-builder in the NPM repository, which used a similar technique to execute a file for stealing passwords. Prior to this, a backdoor was in the dependency of the NPM package event-stream, and the malicious code was downloaded about 8 million times. Malicious packages also in the PyPI repository.
Source: opennet.ru
