Cybersecurity researchers have identified four new packages available on the npm registry that contain information-stealing malware. One of these packages is a clone of the Shai Hulud worm, a tool that was previously open sourced by a group known as TeamPCP. The discovery highlights ongoing risks in the software supply chain for developers who use open source libraries.
Details of the malicious packages
The malicious packages were found by the security research team. The packages and their recorded download counts include the following: chalk-tempalte with 825 downloads, @deadcode09284814/axios-util with 284 downloads, axois-utils with 963 downloads, and color-style-utils with 934 downloads.
Researchers stated that one of the packages, chalk-tempalte, is particularly notable. It is a modified version of the Shai Hulud worm. The original worm was openly shared by the TeamPCP collective, and this clone has been repurposed to carry out malicious activity after being installed on a developer’s system.
Malware Capabilities and Risks
The malware in these packages is designed to steal sensitive information from infected computers. This includes credentials, environment variables, and other data that could provide access to more significant systems. Furthermore, the malware has the capability to turn the compromised machine into a node for a botnet, specifically one used for conducting Distributed Denial of Service (DDoS) attacks.
Experts noted that the attacker behind these packages explicitly called them “Phantom Bot” in the code. The DDoS functionality allows the attacker to command infected systems to flood a target website or service with traffic, effectively shutting it down. The combination of data theft and DDoS functionality creates a dual threat for any organization whose developer accidentally installs one of these packages.
Implications for the Software Supply Chain
The discovery of these four packages underscores the vulnerability of the software supply chain. Many developers automatically download packages from npm when building applications, often without thoroughly vetting the code. Attackers use typosquatting techniques, where the package name is a common misspelling of a popular, legitimate library, to trick developers. In this case, names like “chalk-tempalte” mimic the authentic “chalk” package, and “axois-utils” mimics the “axios” library.
Once a developer installs a malicious package, the code runs with the same permissions as the developer’s user account. This means it can access files, modify project code, and communicate with external servers to exfiltrate data. The 963 downloads registered for the axois-utils package indicate that many developers likely fell victim to this specific software supply chain attack.
How Developers Can Protect Themselves
Security experts recommend several preventive measures. Developers should double check package names for misspellings before installation. Using package lock files and verifying checksums can help ensure that the code being installed is exactly what the developer expects. Additionally, running security scanners and automated tools that flag suspicious behavior in npm packages can catch these threats before they execute.
Organizations are also advised to use private registries that curate and vet packages before allowing them into the development environment. This limits the exposure to malicious code hosted on public registries.
Looking Ahead
The researchers who discovered these packages have reported them to the npm security team. The malicious packages are expected to be removed from the public registry to prevent further downloads. However, because the code is already in the hands of thousands of installers, affected systems may need to be audited and cleaned manually. The incident serves as a reminder that the threat from malicious open source packages is likely to persist, and developers must remain vigilant when adding dependencies to their projects.
Source: Delimiter
