A cluster of nearly 800 malicious packages has been published to the npm registry as part of a new campaign designed to deliver cross-platform malware targeting Windows, Mac, and Linux systems. The npm supply chain attack campaign uses typo-squatted and randomly generated package names to lure developers into installing malicious code.
OpenSourceMalware researcher Paul McCarty identified the campaign and detailed its mechanics. Unlike other npm attacks that use lifecycle hooks like preinstall or postinstall, the npm supply chain attack campaign uses a different approach.
They also come with a README file which tells developers to include them with the require() function, which is a module loader.
Now let me take you through the way an npm supply chain attack campaign operates, its deliverables and what developers should know about it.
The Attack Chain
The npm supply chain attack campaign begins with a developer installing one of the malicious packages and following the README instructions to load it with require(). This causes the WEL1DROPPER downloader to be executed.
The WEL1DROPPER checks the host operating system and architecture. It then fetches a compatible payload from one of three Cloudflare Workers hosts.
The three domains are:
- oob-worker.cf103-070.workers[.]dev
- oob-worker.cf102-baf.workers[.]dev
- oob-worker.cf99-9b3.workers[.]dev
If the HTTPS-based downloads fail, the npm supply chain attack campaign switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage payload. This will ensure that the malware can continue functioning even if the primary delivery method is blocked.
DNS TXT Record Payload Delivery
The method that uses the DNS TXT for delivery in the npm supply chain attack campaign is quite smart. Firstly, the packet is asking for a TXT record from a specific domain. This record is parsed to the number of chunks of the payload, ranging from 1 to 2,000. Then, it will request the numbered TXT records.
The returned strings are joined together and decoded from Base64 format to binary format inside the buffer. Through such process, the supply chain attack campaign gets the ability to deliver payloads in chunks, making detection more difficult.
Finally, the payload is written inside the temporary folder and executed through "/bin/sh" on Linux and macOS, as well as through "cmd.exe" on Windows. The final stage is launched as a detached process.
The Windows Payload
The Windows payload in the npm supply chain attack campaign takes steps to evade detection. It enhances the protection of Event Tracing for Windows and Antimalware Scan Interface by blocking monitoring. The malware is looking for sandboxes and virtualization environments so it can avoid detection.
Persistence comes from using a Run key in the Registry and a scheduled task. Then, it proceeds with downloading its encrypted payload (“/pkg/update_win.exe”) and execution. This multi-stage process increases resilience against detection in the npm supply chain attack campaign.
The macOS Payload
The macOS infection chain in the npm supply chain attack campaign is similar to Windows. It performs an identical set of actions to look for debuggers and analysis artifacts. It will then download the compatible payload ("pkg/beacon_mac.bin") from the remote server.
In case this does not work out, the DNS TXT delivery method is used. It gains persistence via LaunchAgent and executes the payload in a detached process. Some examples of domain names used by the payload for macOS include “tcsbank[.]ru” and “cloudpayments[.]ru,” suggesting the npm supply chain attack campaign may be targeting Russian financial institutions and mobile payments.
The Linux Payload
The Linux sample in the npm supply chain attack campaign is an UPX-packed ELF binary. It is configured to download auxiliary payloads from a Cloudflare Worker URL. This ultimately leads to the deployment of Sliver, an open-source command-and-control framework.
Sliver is a highly developed C2 framework that offers post-exploitation functionalities. It can be seen from the usage of the Sliver framework in the npm supply chain attack that the perpetrators are very skillful.
The Telemetry.js Deception
The malicious packages in the npm supply chain attack campaign also contain a file called "lib/telemetry.js." This file implements a plausible-looking telemetry SDK but also contains the same downloader logic.
The package entry point does not import this file. It contains no additional hard-coded infrastructure. The oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review.
This deception technique makes the npm supply chain attack campaign harder to detect during manual code review. The malicious code is present but not obviously connected to the package's main functionality.
The Connection to Moika
The npm supply chain attack campaign is suspected to be an evolution of a dependency confusion campaign codenamed Moika. That campaign was observed earlier this April and saw over 250 packages published to the npm registry. It stole environment information and delivered an operating system-specific second-stage payload.
The similarities in technique and infrastructure suggest that the same threat actor or group is behind both campaigns. The npm supply chain attack campaign represents a significant expansion of their operations.
Other npm and PyPI Campaigns
The npm supply chain attack campaign is not the only threat targeting JavaScript and Python developers. Palo Alto Networks Unit 42 documented multiple campaigns targeting npm and PyPI.
One set of 10 npm packages downloads an obfuscated cryptocurrency stealer and a remote access trojan from an external server. The payload implements a crypto stealer and RAT that allows the attacker to execute arbitrary commands on the infected host.
Another set of malicious packages across npm and PyPI represents multiple distinct threat actors. These packages are capable of cloud credential exfiltration, delivering EtherHiding blockchain-based C2 droppers, Solana cryptocurrency wallet key theft via Telegram, .env file secret exfiltration, fake-CAPTCHA social engineering remote code execution, and Discord token theft and GitHub Actions CI/CD credential exfiltration.
Chrome Extensions Used for Proxy Networks
Threat actors have also been observed using Google Chrome extensions marketed as game emulators, password managers, productivity tools, CSS inspectors, and markdown converters. These extensions turn the web browser into a web crawling proxy.
The crawl commands are received remotely via a persistent WebSocket connection. The extensions embed an identical commercial web bandwidth-sharing SDK that connects the user's browser to a third-party residential proxy network for web scraping operations.
One notable example is InstaSkip, which embeds this SDK. While some extensions disclose the practice in their Chrome Web Store descriptions and privacy policies, others frame the opt-in as necessary for uninterrupted service.
Implications for Developers
From the standpoint of this attack campaign, which is aimed at the npm supply chain, the developers should be very careful while downloading any packages from the npm registry that look suspicious or do not have enough downloads.
Before installing a package, review its README and source code. Detect possible require() function calls and telemetry files that might have malicious code embedded into them. Dependency scanning tools can be used to detect malicious packages.
In relation to the organization, put in place policies that dictate what software packages can and cannot be installed, and who should install them. Use trusted software package registries when possible, as well as monitor for anomalies in network usage patterns by developers’ workstations.
Wrapping It Up
The npm supply chain attack campaign published nearly 800 malicious packages to the npm registry. The packages deliver cross-platform malware targeting Windows, Mac, and Linux systems through a combination of Cloudflare Workers and DNS TXT records.
The campaign uses a downloader named WEL1DROPPER to identify the host OS and fetch a compatible payload. The Windows version patches ETW and AMSI, checks for sandboxes, establishes persistence, and downloads encrypted payloads. The macOS version performs similar actions. The Linux version deploys Sliver.
The npm supply chain attack campaign is suspected to be an evolution of the Moika campaign. Other campaigns are also targeting npm and PyPI with various malicious capabilities.
Developers should exercise caution when installing npm packages. npm supply chain attack campaign is still in progress and probably will grow further. Be cautious and check packages before installing.
FAQ Section
What is the npm supply chain attack campaign?
It is a campaign that published nearly 800 malicious packages to the npm registry. The packages provide cross-platform malware for attacks on Windows, Mac, and Linux-based computers through Cloudflare Workers and DNS TXT records.
How is the attack carried out?
The packages contain a README file that explains that the developer should load the packages using require(). As a result, WEL1DROPPER will detect the operating system and download the corresponding payload using Cloudflare Workers or DNS TXT records.
What platforms are targeted?
The campaign targets Windows, Mac, and Linux systems. The Windows version patches ETW and AMSI. The macOS version checks for debuggers. The Linux version deploys Sliver C2.
What is the connection to Moika?
The campaign is suspected to be an evolution of the Moika dependency confusion campaign observed earlier this year. Similarities in technique and infrastructure imply that there is the same threat actor involved.
What measures can developers use to protect themselves?
They should check package README and code before installing packages. They need to see whether there are any strange require() functions. They should use dependency scanning software. They should make policies about installing packages.
