Malicious code continues to be uploaded to open source repositories, making it difficult for responsible developers to trust the content and for CISOs to trust applications that include open source. The latest example comes from researchers at Datadog Security, who reported that last month they found 17 packages (23 versions) in the npm repository that contained a malicious downloader for Windows systems, which is executed via a postinstall script.
See also: NPM Breach: New Business Email Protection Technique
The linked packages pretend to be Telegram bot helper packages, icon libraries, or legitimate forks of pre-existing projects like Cursor and React . They provide legitimate functionality, but their real purpose is to execute the Vidar infostealer malware on the victim’s system. Datadog believes this is the first public disclosure of Vidar malware delivered via npm packages. Both accounts that offered these packages (aartje and saliii229911) have now been banned.
However, it was in the registry for about two weeks, and the malicious packages were downloaded at least 2,240 times. Researchers believe that many of these downloads were likely made by automated scrapers, with some occurring after the packages had been removed and replaced with empty security packages. Malicious compromise of open source components can lead to all sorts of bad situations. First, threat actors can steal developers’ credentials and insert backdoors into their code. Second, the malicious code in the downloaded component could spread to all of the developer’s clients.
Datadog's discovery is just one more in a long list of malicious code that has been uploaded to npm, PyPI, GitHub, and other open source repositories. Last week, Koi Security reported finding 126 malicious packages in npm, and in September, researchers at Step Security reported that dozens of npm libraries had been replaced with credential-stealing code. That same month, researchers at Aikido reported that 18 highly popular and downloaded npm packages had been infected.
See also: PhantomRaven: 126 malicious npm packages with 86,000 downloads
A favorite tactic of malicious actors trying to infect the open source software supply chain is typosquatting, the creation of packages with names similar to legitimate ones to mislead unsuspecting developers looking for a specific library. For example, in 2018 a researcher found that hackers had created fake libraries in the Python repository called 'diango', 'djago', 'dajngo', to mislead developers looking for the popular Python library 'django'.
CISOs should ensure that employees are aware of the issue of typosquatting and learn what to look out for. IT departments should maintain a complete inventory of the elements used by all approved software, against which audits can be conducted, to ensure that only approved elements are in place. This inventory and audit should be performed to validate any new elements that are introduced.
What else can you do?
One tactic is to include a software inventory with every application an IT department acquires. This DevOps/DevSecOps to monitor software assets, identify vulnerabilities, and ensure compliance. In 2021, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the U.S. National Institute of Standards and Technology (NIST) published an advisory, Defending Against Software Supply Chain Attacks, providing advice on building secure open source applications.
See also: 175 malicious npm packages used to collect credentials
It starts with creating a formal supply chain risk management program to ensure that supply chain risk is addressed across the organization, including among executives and managers in operations and staff in support roles such as IT, procurement, legal, risk management and security. An organization can reduce its software attack surface through configuration management, the consultancy says, which includes: placing configurations under change control; conducting security impact analyses; implementing manufacturer-provided guidelines for hardening software, operating systems and firmware; and maintaining an inventory of information system components.
🔑 Secure your passwords with Proton Pass
Password manager from Proton — end-to-end encryption, passkeys, built-in 2FA, and monitoring for leaks of your credentials.
- ✔ Encrypted storage of passwords & passkeys
- ✔ Notification if any of your passwords are leaked (Dark Web Monitoring)
- ✔ Free version — on all devices
The link is an affiliate link — SecNews may receive a commission at no additional cost to you. It does not affect the independence of our article writing.
