Hundreds of Malicious Packages Found in npm Registry

Security researchers discovered over 400 malicious packages in the popular open source registry npm in December, and dozens more in PyPI.

Sonatype explained in a blog post that its AI tooling spotted 422 malicious npm packages focused mainly on data exfiltration via typosquatting or “dependency confusion attacks.” Additionally, it found 58 malicious packages in PyPI, including heavily obfuscated Discord token stealers.

That brings the total number of open source packages flagged by the vendor as malicious to nearly 104,000 since 2019.

These open source components have become near-ubiquitous in development projects as they offer a useful way to accelerate time to market. The top four ecosystems now boast estimated annual requests of over three trillion.

However, cyber-criminals are increasingly inserting malware into packages in the hope they are unwittingly downloaded by developers.

Among the malicious packages that caught Sonatype’s attention from December were several focused on macOS developer environments, including an infected version of crypto library Cobo Custody Restful.

“The attackers leveraged the fact that this package doesn’t have an official distribution through the PyPI registry,” Sonatype explained.

“By uploading a compromised version with the same name on PyPI, attackers expect that the package manager (pip) used by developers will prioritize the malicious version over the legit GitHub version.”

The vendor detected a further six PyPI packages targeting Python developers with the same tactic – combining the capabilities of a remote access Trojan and info-stealer in a novel way.

“With names such as easytimestamp, pyrologin, discorder, discord-dev, style.py and pythonstyles, the malicious packages launch a PowerShell script that fetches a ZIP file and in a RAT fashion, installs the libraries pynput, pydirectinput, and pyscreenshot that allow the attacker to control the target’s mouse and keyboard, and take screenshots,” Sonatype explained.

“Additionally, these malicious packages are also stealers, with the ability to extract sensitive information such as saved passwords, cryptocurrency wallet data and cookies. They also seek to install cloudflared, a command-line tool for Cloudflare Tunnel, which would allow remote access to the infected machine via a Flask-based app.”

According to Sonatype’s most recent State of the Software Supply Chain report, there’s been a 743% increase in this kind of malicious activity in the past three years.