Researchers in cybersecurity have discovered 36 malicious npm packages attempting to masquerade as plugins for the widely used open source Content Management System (CMS) Strapi.
Each of the 36 packages displayed similar characteristics: they were named beginning with strapi-plugin- (for example, strapi-plugin-cron, strapi-plugin-database, strapi-plugin-server), there were no descriptions, repositories or homepages associated with them, and they all had the same version number (3.6.8) to make them look like mature community-introduced plugins compatible with Strapi v3. None of these packages were scoped with the official @strapi/ namespace.
The accounts that uploaded these packages appeared to be four separate individuals; “umarbek1233”, “kekylf12”, “tikeqemif26”, and “umar_bektembiev1”. They uploaded the malicious packages within a single thirteen-hour timeframe.
The malicious code actually resided within a postinstall.js script, which automatically runs upon the execution of "npm install". As postinstall.js is executed as the same user (usually as root within Continuous Integration/Continuous Deployment (CI/CD) or Docker containers), this gave the attacker sufficient control to attack any associated applications.
Different Payloads Used
An investigation by SafeDep shows that the attacker deployed at least 8 different payloads, showing a clear progression of tactics over time.
1. The initial payloads focused on exploiting Redis by creating crontab entries that would download shell scripts, deploying PHP web shells, and implementing Nodejs reverse shells.
2. Some of the later variants tried to escape the docker container to write files back to the host system.
3. As time progressed, payloads began to drift away from exploitation of environment variables, database connection strings for PostgreSQL and sensitive files, focusing primarily instead on reconnaissance.
4. Also, the most sophisticated payloads utilized credential-based attacks against PostgreSQL by dumping Strapi tables for cryptocurrency data (e.g., wallet addresses, transaction hashes, hot/cold storage) and searching for other relevant information.
5. Finalized payloads were also focused on creating persistent implementations and procedures for credential theft.
Taken together, the focus on cryptocurrency-related data coupled with hard-coded database credentials strongly suggest that the aim of the attacks has been to compromise a certain cryptocurrency platform/exchange.
Broader Supply Chain Context
The supply chain is in the midst of a surge of attacks within the open-source environment. Some of the recent examples include:
1. A GitHub account posting large volumes of repositories containing pull requests with credential stealers.
2. A verified "dev-protocol" organization was hacked to supply users with malicious Polymarket trading bots.
3. Legitimate packages hosted within npm, PyPI, and the VS Code extension marketplaces have been compromised.
4. Account takeover and abuse of workflows in GitHub Actions.
Each of these events is further evidence that package repositories, like the npm registry, are now major targets for attackers who want to gain extensive, covert access to development environments and users downstream from the developers.
Recommendations
If you use Strapi or npm packages in your organization, you should do the following:
1. Immediately check to see if you have installed any of these malicious packages.
2. If you do have these malicious packages installed, assume that your system has been compromised and you should rotate all of your credentials, especially your database credentials, API keys and any cryptocurrency-related secrets.
3. Review your CI/CD pipelines and Docker images for any suspicious activity that may have occurred during the postinstall process.
4. Consider using tools to scan for malicious or suspicious npm dependencies.
This campaign serves as a classic example of how supply chain attacks are still evolving and becoming more sophisticated. Even though these plugins may seem to have an innocent name, it is important to note that any plugin uploaded to a npm registry could compromise your organization.
Please make sure you are very careful with your dependency management practices, as it has become one of the most important aspects of application security within today's threat landscape.
Source: The Hacker News
