New npm malware finds a way around install script defenses

The discovery comes after npm introduced tighter controls around lifecycle scripts in June.

Blockchain C2 combined with Slack/Telegram data theft

The malicious script was embedded directly into a runtime method “BTree.prototype.set”, instead of an install hook in the package’s package.json. When the method receives a particular key value, the code launches an obfuscated first-stage loader as a detached Node.js process.

Once launched, the loader fingerprints the host, collecting information including the operating system architecture, hostname, CPU, memory and uptime. The data is then exfiltrated using hardcoded Slack channel and Telegram chats.

The attackers hid the command-and-control (C2) server address in a smart contract on the Sepolia Ethereum testnet blockchain.

“The contract exposes getter and setter functions that the malware polls instead of requesting a plain domain,” Checkmarx researchers said. “This technique is more resilient to domain / IP takedown than traditional C2 approaches, since it uses the smart contract as a pointer to a new address whenever the old one gets taken down.

Further in the chain, the malware creates cryptographic keys to establish a shared secret with a public key retrieved from the blockchain. This secret is ultimately used to unlock a second-stage payload from two encrypted chunks in the smart contract.

Checkmarx did not say what the second-stage loader does, but it did point out that the malware cleans up after itself. It contains “functionality to delete the malware files and remove the trigger code from the main prototype function,” the researchers noted.

Nine more packages broaden the campaign

Checkmarx also identified nine other npm packages linked to the campaign, which were subsequently removed from the registry. These included ordered-kv-index, btree-leaderboard, priority-slot-queue, btree-range-store, btree-core, btree-time-index, btree-lru-cache, neighbor-key-map, and sliding-score-window.

Several of these packages had hundreds of thousands of downloads, while btree-core had more than 1.9 million downloads.

The operators tried making the package ecosystem look legitimate, Checkmarx noted, maintaining a GitHub repository with numerous commits while keeping the malicious code itself out of the repository. The associated GitHub account too used an AI-generated profile image.

Checkmarx said the campaign is ongoing and that its findings may change as the investigation develops. It shared a list of indicators of compromise (IOCs) for security teams to use in detection and monitoring.

This article first appeared on InfoWorld.