Sophisticated npm Supply-Chain Campaign Targets Developers with Malicious Packages
In a significant development highlighting the vulnerabilities within software package ecosystems, security researchers have uncovered a sophisticated npm supply-chain campaign linked to a series of ten malicious JavaScript packages. These packages, collectively responsible for millions of downloads, managed to evade npm’s lifecycle-script protections, posing a severe threat to developers and their applications.
At the center of the operation is a counterfeit package named indexed-btree, which masquerades as the legitimate sorted-btree library. This deceptive package executes malicious code only when an application calls it during runtime, thus circumventing the typical security measures that watch for unsafe actions during installation phases. Unlike traditional npm malware campaigns that often leverage preinstall, install, or postinstall hooks to trigger their malicious code, this operation has innovatively embedded the malicious loader directly into BTree.prototype.set(), a core library function likely to be invoked regularly by genuine applications.
The package’s package.json file has been crafted to appear harmless as it contains no suspicious lifecycle hooks, which would ordinarily trigger npm’s security protocols introduced in version 12. These protocols require explicit approval for the execution of dependency scripts. By sidestepping these protections, the malicious package has illustrated the evolving tactics employed by cybercriminals seeking to exploit the npm ecosystem.
A pivotal aspect of the malware’s functionality is a runtime check that assesses whether the set() function is invoked with the key value 100. Upon meeting this condition, an obfuscated loader file named sharedLoad.min.js is launched in a detached Node.js process, thereby concealing malicious activity from ordinary analysis and allowing it to seamlessly blend in with normal program behavior. This execution path effectively diminishes the efficacy of install-time controls and static package reviews that concentrate primarily on lifecycle scripts.
To bolster the credibility of the malicious package, the attackers have established a GitHub repository featuring an extensive commit history and a seemingly authentic developer profile. They kept the malicious code concealed from public view, enhancing the package’s appearance of legitimacy. The initial loader has been heavily obfuscated, employing string-array encoding alongside self-defending code structures, which complicates efforts to dissect its operations.
Once activated, the malware collects critical information about the compromised host. It retrieves details such as the operating system architecture, hostname, CPU specifications, memory metrics, and system uptime. This collected data is then exfiltrated through hardcoded channels linked to Slack and Telegram infrastructure, revealing a troubling level of sophistication in the attackers’ approach.
Reports from Checkmarx indicate that the strategically deceptive indexed-btree package has amassed nearly two million weekly downloads, underscoring the extensive reach of this campaign. The malicious operation’s scale exemplifies how runtime-focused packages can achieve significant traction, effectively reaching unsuspecting users and developers alike.
Moreover, this malware is particularly insidious as it utilizes an Ethereum Sepolia testnet smart contract to function as its command-and-control (C2) mechanism. Instead of direct communication with a traditional C2 domain or IP address, the malware polls the contract’s getter and setter functions for updates and payload data. This clever method complicates efforts to dismantle the criminals’ infrastructure, enabling the operators to re-route compromised systems to new infrastructures through on-chain updates, rather than being reliant on hardcoded domains embedded within the malicious software.
In addition to these complexities, the loader employs an X25519 elliptic-curve Diffie-Hellman key exchange to facilitate secure communications. It generates a local X25519 key pair before retrieving the operator’s public key from the smart contract. This shared secret is then used to create an AES key that decrypts various encrypted payload fragments stored on-chain, dynamically reconstructing the second-stage malware.
To further obscure their tracks, the malware contains cleanup functionality that is designed to delete its files and remove any triggers linked to the malicious prototypes after execution, thereby limiting the scope for any forensic investigation following an attack.
Checkmarx’s analysis identified indexed-btree as the main malicious package while establishing connections to nine additional packages, including ordered-kv-index, btree-leaderboard, and btree-core. Notably, btree-core alone recorded 1,951,274 downloads, with the other linked packages each gaining hundreds of thousands more. Since their discovery, these malicious packages have been removed from the npm registry, but the ramifications of their existence remain a significant concern.
The campaign’s connection to smart contracts was also linked to a previously recognized mutex-forge package, establishing a continuum of malicious activity. As of the latest research, the threat actors appear to control 109 ETH, valued at approximately €230,933.57, although the analysis does not confirm that the entire balance was obtained through this campaign.
Given the critical severity of the indexed-btree package, which has been classified as malicious with a severity rating of 9.3 by Snyk, organizations are strongly advised to refrain from utilizing any instances of the package. For those that have installed any of the ten identified packages, it is imperative to treat affected development and build environments as potentially compromised. This includes rotating credentials, API tokens, SSH keys, and other sensitive data, along with conducting comprehensive audits of software bills of materials and dependency lockfiles.
In light of this evolving threat, the adoption of runtime behavior monitoring has become essential. The absence of lifecycle scripts should no longer offer a false sense of security regarding the safety of npm dependencies. As cyber threats continue to evolve, vigilance must remain a top priority among developers, emphasizing the need for robust security practices in software development.