New Campaign Distributes Malicious npm and PyPI Packages to Pilfer Kubernetes Config, SSH Keys

Researchers have discovered a concerning surge in deceptive npm and PyPI packages distributed as part of a malicious campaign, aimed at extracting Kubernetes configurations and SSH keys from compromised systems.

The First Signs of the Campaign

The campaign was first identified on September 12, 2023, and has been ongoing since then.

Initially, a total of 14 malicious npm packages were identified as part of this campaign, published from different npm accounts:

• @am-fe/hooks
• @am-fe/provider
• @am-fe/request
• @am-fe/utils
• @am-fe/watermark
• @am-fe/watermark-core
• @dynamic-form-components/mui
• @dynamic-form-components/shineout
• @expue/app
• @fixedwidthtable/fixedwidthtable
• @soc-fe/use
• @spgy/eslint-plugin-spgy-fe
• @virtualsearchtable/virtualsearchtable
• shineouts

What links these accounts is the utilization of a certain domain within malicious packages: “app.threatest[.]com”

The malicious packages appear to be benign JavaScript libraries and components, such as ESLint plugins and TypeScript SDK tools; once installed, they run obfuscated code to extract sensitive files from the victim’s machine. 

Threat actors are actively uploading such packages to various ecosystems, with the intention of infecting unsuspecting users and exfiltrating data. The threat is significant, as it can potentially result in severe issues for organizations in targeted attacks, including supply chain compromises. To gain insights into the methods employed by threat actors for distributing malicious packages, you can refer to our other blog post.

Example of a Malicious npm Package

Researchers have made several noteworthy observations about these malicious packages. For instance, one package is named “fixedwidthtable” but directs users to a GitHub repository called “typescript-sdk-tools,” and an “index.js” file in the scripts folder runs obfuscated code.

Packages linked to this campaign contain the same code and attempt to mimic legitimate open-source libraries, though the actual files differ.

Researchers further revealed that earlier versions of some of these packages contain an unobfuscated version of the attack payload. This discovery confirmed the attackers’ intent to pilfer sensitive data, including: 

• Kubernetes configurations,
• SSH keys,
• System metadata (usernames, IP addresses, hostnames).

When the code is executed on the victim machine, it collects the targeted data and sends it to the app.threatest[.]com domain.

Is There a Specific Threat Actor Distributing These Malicious npm and PyPI Packages?

The domain used in the campaign (app.threatest[.]com) was found to resolve two Cloudflare IP addresses. Additionally, researchers observed the use of Chinese characters in code comments, which is noteworthy. Nevertheless, this information does not provide a clear identification of a specific threat actor.

In the subsequent days of the campaign’s launch, researchers identified additional packages. The campaign began with an initial release of packages in the npm package repository, but as it evolved, the attackers expanded their distribution to include packages on PyPI.

Researchers report that, to date, the campaign has generated a total of 46 publications across 39 distinct packages within the two ecosystems (npm and PyPI).

You can find a comprehensive list of all the campaign-related packages at the end of this blog.

Proactively Defend Your Environment with SOCRadar

With the Supply Chain Intelligence feature under SOCRadar’s CTI module, you can include your vendors on a WatchList and stay vigilant regarding the most recent incidents that might have implications for your organization’s security.

Additionally, more than often, attackers use vulnerabilities in infected systems to further exploit their victims. With SOCRadar, you can promptly receive alerts regarding vulnerabilities identified across your digital assets, enabling proactive defense measures for your organization.

All npm and PyPI Packages Related to the Campaign

The following is a complete list of malicious packages published so far in the campaign:

(Source: Phylum)