InfoSecBulletin Cybersecurity for mankind
A group of almost 800 harmful packages was added to the npm registry in a new effort to spread malware that works on Windows, Mac, and Linux. “These packages appear to use AI slop squatted, or randomly generated typo-squatting package names, but all of them deliver a powerful RAT and infostealer payload,” Open Source Malware researcher Paul McCarty said.
Unlike other attacks on npm software that use hooks like preinstall or post install to run bad code, the new packages have a README. This README tells developers to load them using require(), a built-in function to bring in modules, local files, and outside packages.
700 AI agents united to hack Hugging Face after breaking isolation
ServiceNow warns of three critical security vulnerabilities
100+ Tech and Security Orgs Urge Global Cyber Defense Boost Against AI Threats
8.7 Million Customers data exposed from 3 Airports
Crack 85 Accounts and Steal 2,500+ Records
8-Agent AI Framework Used to Compromise Gov’t Entities in Asia
270+ Zimbra servers compromised in continuous attacks
Singapore Approves 200MW Data-Centre Expansion Under Second Call
Chameleon SEO Poisoning
Hackers poison Bing and Google search results to deliver phishing banking pages
Mysterious AI model “Ox Alpha” with free 100 trillion tokens a day for coders
After BDJobs, Directorate of Secondary and Higher Education 390k data surfaced online
The attack causes a downloader called WEL1DROPPER to run. When it runs, it checks the type of operating system and processor. It then gets a suitable payload from one of three Cloudflare Workers hosts. Here are the three Cloudflare Workers domains –
oob-worker.cf103-070.workers[.]dev
oob-worker.cf102-baf.workers[.]dev
oob-worker.cf99-9b3.workers[.]dev
If the HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage from the domain “wel1[.]ru.” The payload domain for each operating system and CPU architecture is as follows :
Linux x64 – sdk.dl.wel1[.]ru
Linux ARM64 – ext.dl.wel1[.]ru
macOS – pkg.dl.wel1[.]ru
Windows – net.dl.wel1[.]ru
“The package first requests a TXT record from c.<domain>,” McCarty explained. “It parses the response as the number of payload chunks, accepting a value between 1 and 2,000. It then requests numbered TXT records. The returned strings are joined together and Base64-decoded into a binary buffer.”
The payload is saved in a temporary folder and run using “/bin/sh” on Linux and macOS, or “cmd.exe” on Windows.
Sonatype, which is tracking the Flooding Dropper campaign, said the last stage starts as a separate process. The Windows version tries to fix Event Tracing for Windows (ETW) and Antimalware Scan Interface (AMSI) to avoid detection, check for sandbox and virtual settings, stay active by using a Registry Run key and a scheduled task, and download an encrypted file (“/pkg/update_win.exe”) to run it.
The macOS infection process is the same. It checks for debuggers and analysis tools before getting a suitable file (“/pkg/beacon_mac.bin”) from a remote server. If that doesn’t work, it uses DNS TXT delivery, creates a LaunchAgent for persistence, and runs the executable in a separate process.
The Linux sample is an ELF binary packed with UPX. It is set to download extra files from a Cloudflare Worker URL (“oob-worker[.]cf99-9b3.workers[.]dev”), which finally helps install Sliver, a free command-and-control (C2) system.
The packages have a file named “lib/telemetry.js.” This file acts like a real telemetry SDK, but it also has the same downloader code.
“The package entry point does not import this file, and it contains no additional hard-coded infrastructure,” OpenSourceMalware said. “The oversized telemetry implementation appears intended to add noise and make the malicious behavior look like native profiling or analytics functionality during a quick review.”
The presence of domains like “tcsbank[.]ru” and “cloudpayments[.]ru” in the macOS payload indicates that the campaign could be targeting Russian financial institutions and mobile payments.
It’s thought to be a new version of a dependency confusion plan called Moika. This plan was seen earlier in April. It had over 250 packages put onto the npm registry to take environment data and send a second stage attack for specific operating systems.
The development comes as Palo Alto Networks Unit 42 documented multiple campaigns targeting npm and the Python Package Index (PyPI) repository :
A group of 10 npm packages downloads a hidden cryptocurrency thief and a remote access virus from another server. “Once installed, the packages offer a ‘getPlugin’ function that makes the URL for the download using a tricky IIFE (Immediately Invoked Function Expression) JavaScript code inside a JSON object,” said Unit 42. “The download has a crypto thief and Remote-Access Trojan (RAT) that lets the attacker run any commands on the infected computer.”
A group of harmful packages on npm and PyPI from different threat actors can steal cloud credentials, send EtherHiding blockchain droppers, steal Solana cryptocurrency wallet keys through Telegram, take secrets from .env files, trick people with fake CAPTCHA to run code remotely, and steal Discord tokens and GitHub Actions CI/CD credentials.
From Packages to Chrome Extensions
Threat actors have been seen using Google Chrome add-ons that are sold as game emulators, password managers, tools for productivity, CSS inspectors, and markdown converters to make the web browser act like a web crawling proxy. The crawl commands come from a constant WebSocket connection.
“These extensions embed an identical commercial web bandwidth-sharing SDK that connects the user’s browser to a 3rd party residential proxy network for web scraping operations,” Unit 42 said, adding it crawls pages by injecting a hidden iframe into active browser tabs, converts page content to Markdown in the background, and sends it to a remote cloud backend.
The cybersecurity company said that some of these extensions mention this practice in their Chrome Web Store descriptions and in the privacy policies on their SaaS websites. After users install them, the third-party SDK asks users to join the service.
“While the proxy and crawling features remain inactive if the user declines, some extensions frame this opt-in as necessary for uninterrupted service,'” Unit 42 said. “A notable example is InstaSkip (mdondgockboebafloibbhjofmoedmnnn), which embeds this SDK.”
