In a troubling first, security researchers have stumbled upon a malicious open-source package with rootkit capabilities. This revelation has signalled a worrying trend in malware distribution through open-source projects.
The malicious open-source package was discovered when researchers from ReversingLabs were conducting routine monitoring of the npm public repository.
The researchers found that this malevolent typosquatting campaign used in a sophisticated supply chain assault has been ongoing since August.
The typosquatting tactic
Typosquatting is a technique wherein cybercriminals create malicious packages with names resembling legitimate and widely used open-source modules.
The module’s name in this attack was ‘node-hide-console-windows’, mimicking the legitimate npm package ‘node-hide-console-window’. Notice the missing ‘s’ in the legitimate npm package’s name.
To further blur the lines, the attackers replicated the npm page for the malicious package to resemble the legitimate one closely. This deception extended to creating ten different versions of the malicious packages, mirroring the legitimate package’s version history.
The malware
Researchers have discovered that the package harboured malicious code within its ‘index.js’ file, listed as the primary file in ‘package.json’.
Upon execution, the code fetched an executable that was a copy of ‘DiscordRAT 2.0’, an open-source ‘Discord Remote Administration Tool’ ostensibly intended for education. This revelation marked a critical turning point as it unveiled malware’s infiltration of open-source projects.
DiscordRAT 2.0
DiscordRAT 2.0 is a tool that simplifies remote administration. It allows malevolent actors to control infected hosts by executing various commands, including disabling security features, killing processes, and even shutting or blue-screening compromised devices. This ease of use, coupled with detailed instructions in the ‘readme.md’ file, makes DiscordRAT 2.0 accessible even to less-experienced attackers.
This malicious code was found to be registering itself with the Discord developer portal and subsequently added to a Discord server or guild, providing malevolent actors with a platform to manipulate their targets. The research team extracted ey identifiers, including the bot taken and guild ID used in this malicious executable.
All ten versions of ‘node-hide-console-windows’ analysed by the researchers downloaded the same malicious executable housing DiscordRAT 2.0. In addition to that, the final two versions downloaded an additional malicious payload disguised as a Visual Studio Code update.
The malicious payload hidden within the Visual Code update was identified as a PyInstaller-compiled executable serving ‘Blank-Grabber’, an infostealer written in Python 3.
Although the impact of this campaign appears to be limited, it raises critical questions within the developer community. On one hand, the meticulous effort to make the malevolent packages appear trustworthy is evident.
The creation of a convincing npm page and the replication of legitimate package versions demonstrate a calculated approach. However, as all the components involved in this attack are open-sourced, it has amplified the threat, making supply chain attacks feasible for a broader range of actors.
Researchers have urged organisations to observe vigilance, scrutinise the behaviours of open-source, third-party, and commercial code, and monitor for potential malicious payloads while the developers remain attentive while incorporating packages from public repositories into their projects.
In the News: Attackers are targeting SQL Server instances for lateral access
