When the dependencies betray you: the npm campaign that steals credentials and cryptomoneda coins

Today we see how software security is hit with social engineering and organized crime economy: researchers have discovered a burst of malicious packages published in the npm record that, disguised as legitimate utilities and bookstores, proceed to steal credentials and cryptomoneda portfolios from unanticipated developers and administrators.

The origin of the detection comes from a detailed analysis describing a multi-stage campaign: the researched bookstores show during the installation what appear to be authentic npm logs and add random delays to simulate real downloads, until they jump messages that indicate lack of writing permits in / usr / local / lib / node _ modules. This notice is used as a pretext to request the administrator or root password. If the user type it, the next step is silent: a download that contacts channels in Telegram to get the URL of the final payload and the key to decipher it. The result is the delivery of a remote access Trojan (RAT) or a stealer capable of exfiltering sensitive data, including browser credentials, SSH keys, cloud supplier configurations and cryptomoneda coins.

ReversingLabs was one of the signatures that documented this methodology and baptized it in his report as part of the campaign they are tracking. You can read your technical analysis in detail on your blog: ReversingLabs - npm fake install log RAT. In parallel, other public investigations have found very similar patterns in GitHub repositories that first act as harmless projects and, after gaining a certain reputation, introduce malicious installation scripts that trigger the infection chain. Jamf Threat Labs has published a breakdown that shows how these repositories are even based on IA-oriented workflows to seem legitimate: Jamf - GhostClaw & GhostLoader analysis.

A particularly worrying aspect is the attacker's patience: to publish seemingly benign code, to accumulate "stars" and activity to build confidence and then to update or add a README that leads to the execution of a script on the developer's team. In some cases the installer includes an environment variable that allows to alternate between a complete installation interface - with progress bars and user questions - and a minimalist mode that only collects credentials. This degree of sophistication shows that it is not improvised scripts, but a planned operation to maximize the probability of deception.

The malicious pieces seen in the reports suggested common tools and SDKs: from React optimization utilities to alleged trading bots and macOS utilities, with names that sought to take advantage of trust or thematic relevance among developers. Potential victims are instructed to execute commands that require high privileges; that moment is critical because it allows the attack chain to plant components with sufficient permits to access protected data and to persist in the machine.

The exfiltration of information also reveals operational ingenuity: in some cases the stolen data are sent to Telegram bots associated with different "partners" according to a campaign identifier, and monetization is completed by readdresses of affiliates stored in intelligent contracts of Binance Smart Chain, so that the malicious actor can update routes and monetize without touching the distributed malware code. An analysis that deepens this criminal economy appeared on Panther's blog: Panther - Phantom Menace: Ghost Loader infostealer campaign.

What lesson does this leave for those who work with Node.js, code repositories and modern workflows? The first is that the default confidence in the supply chain is no longer secure. Run suggested scripts on a README or enter sudo to "optimize the system" should immediately activate the alarms. Instead, it is appropriate to check exactly what the installation scripts (the postinstall scripts in package.json) run, review the activity and history of the maintainer, and prefer tools that do not need to raise system privileges for global installations. Node's official documentation on package managers and the recommendation to use version managers as nvm to avoid global sudo facilities is a useful resource to reduce the attack surface: nvm (Node Version Manager) and Node.js' guides on safe facilities are good starting points.

In addition, teams should strengthen the process of incorporating units with automated reviews and controls: review packages that run postinstall scripts, audit changes in repositories that are used as unit sources, and put in place supply chain security tools such as those that propose community initiatives and code platforms. GitHub Security Lab and OpenSSF offer guides and risk mitigation resources in supply chain software: GitHub Security Lab and OpenSSF.

If you think you have been affected, act cautiously: change compromised passwords and keys, check outgoing processes and connections from the affected machine, and, if it was an account with access to repositories or infrastructure, break the credentials and tokens. Reporting malicious packages to the npm security team and to the platforms where the repositories were housed helps to cut the spread; npm has channels to report abuse and vulnerabilities in published packages.

Ultimately, the campaign shows that the attackers are adapting their tactics to the development ecosystem: they combine social engineering, abuse of legitimate platforms such as npm and GitHub, and modern control channels such as Telegram to build a complete chain of attack. The defense requires not only automatic tools, but also clear prudence and processes when installing software and granting privileges. Keeping informed and applying simple habits - not running scripts from unverified sources, avoiding unnecessary sudo, and auditing dependencies - greatly reduces the risk of becoming the next victim.

To expand technical information and see the complete findings, review the above-mentioned reports of ReversingLabs, Jamf and Panther, which dementuate the installation, persistence and exfiltration phases of these campaigns: ReversingLabs, Jamf and Panther.