AsyncAPI npm packages infected with credential-stealing malware
Five malicious versions of AsyncAPI packages were published to the Node Package Manager (npm) in a supply-chain attack that delivered a remote access trojan with info-stealing capabilities. The threat actor exploited a misconfigured GitHub Actions workflow and pushed troj…
Intelligence analysis by Llama
A threat actor compromised two AsyncAPI GitHub repositories and injected malware into project files, resulting in the publication of five malicious versions of AsyncAPI packages to npm. The malware delivered a remote access trojan with info-stealing capabilities, targeting credentials, authentication keys, tokens, browser data, and sensitive information from CI/CD systems and AI devel…
Imagine you're building a house, and someone sneaks in and replaces your tools with fake ones that can steal your secrets. That's what happened with the AsyncAPI packages. A bad actor replaced the good packages with fake ones that can steal things like passwords and credit card numbers. This is a big deal because it can help the bad actor get into other people's systems and steal their secrets too.
Analysis
A $60B Vote of Confidence
The recent supply-chain attack on AsyncAPI npm packages has left the developer community reeling. The threat actor, who exploited a misconfigured GitHub Actions workflow, pushed trojanized packages in the @asyncapi namespace that had a cumulative weekly download count of more than 2.25 million. This attack is a stark reminder of the importance of securing software supply chains and the need for developers to be vigilant in monitoring their dependencies for potential security threats.
The malicious AsyncAPI packages, which included @asyncapi/generator 3.3.1, @asyncapi/generator-helpers 1.1.1, @asyncapi/generator-components 0.7.1, @asyncapi/specs 6.11.2-alpha.1, and @asyncapi/specs 6.11.2, were designed to deliver a remote access trojan with info-stealing capabilities. The malware targeted credentials, authentication keys, tokens, browser data, and sensitive information from CI/CD systems and AI developer tools.
The attack flow diagram, provided by Step Security, shows the intricate details of the malware's operation. The first-stage implant in the published packages is an obfuscated JavaScript statement that ultimately triggers a downloader when the infected file is imported. A second-stage script, which contains configuration details and the main runtime, is retrieved from the IPFS peer-to-peer content delivery network and launched as a hidden process.
Cloud and application security company Wiz notes that the third-stage payload is a 92,000-line malware framework with modular architecture, which establishes persistence on the system and communicates with the command-and-control (C2) server over several channels: HTTP, Nostr relays, Ethereum smart contracts, and a libp2p mesh network.
The malware's purpose appears to be stealing secrets, which include credentials, authentication keys, tokens, browser data, sensitive information from CI/CD systems and AI developer tools, cryptocurrency wallets, and databases. Additionally, the malware code allows it to download the Gitleaks and HackBrowserData tools to help with collecting sensitive information.
However, a report from cybersecurity company Aikido notes that all these functions do not work and the data harvesting tool exits before collecting anything. Nevertheless, the researchers say that all this can be achieved manually using the shell.
Ox Security also noted that the malware performs a local check for Russia, and if there's a match, it terminates its process.
As of writing, all five versions of the four malicious packages have been removed from npm, but developers should note that existing installations and lock files created during the exposure window may still contain the malicious releases. The exposure window extends to approximately four hours and seven minutes, between 07:10 and 11:18 UTC on July 14.
The recommended action is to pin to known-good files, regenerate lock files, remove the hidden 'NodeJS/sync.js' payload, terminate all malicious processes, and rotate credentials on the impacted systems.
Test every layer before attackers do
Key points
- Five malicious versions of AsyncAPI packages were published to npm in a supply-chain attack.
- The threat actor exploited a misconfigured GitHub Actions workflow to push trojanized packages.
- The malware delivered a remote access trojan with info-stealing capabilities, targeting credentials, authentication keys, tokens, browser data, and sensitive information from CI/CD systems and AI developer tools.
- The attack highlights the importance of securing software supply chains and the need for developers to be vigilant in monitoring their dependencies for potential security threats.
The removal of the malicious packages from npm is a positive step towards mitigating the damage. Additionally, the developer community's swift response to the attack demonstrates their commitment to securing software supply chains.
The attack highlights the ease with which threat actors can compromise software supply chains. The fact that the malware was able to evade detection and steal sensitive information from CI/CD systems and AI developer tools is a concerning trend.
