Fortiguard Labs has issued a warning regarding a collection of malicious packages discovered within the Node Package Manager (npm), which is the largest JavaScript software registry.
In a blog post dated October 2, Fortiguard’s Jin Lee and Jenna Wang revealed that these packages have the intent of “stealing sensitive data, such as system or user information, via a webhook or file-sharing link.”
Lee and Wang noted that they had identified some packages that, despite being obfuscated, were still capable of exfiltrating sensitive data. This data included critical information such as Kubernetes configurations, SSH keys, and basic system fingerprinting details like usernames, IP addresses, and hostnames.
These malicious packages often used seemingly harmless names like “webpack,” “fixedwidthtable,” and “virtualsearchtable.”
Another group of packages within this collection sent HTTP GET requests to specific URLs, scanning for sensitive files and directories containing valuable intellectual property and configuration data. Once located, this data was extracted and uploaded to an FTP server.
These packages were able to capture source code, configuration files, and directories containing sensitive information, including application and service credentials.
Fortiguard identified a total of nine groups of malicious npm packages that exhibited similar behaviors.
The malicious activity was primarily concealed within install scripts that executed whenever the malicious package was used.
This discovery highlights the persistent challenge of malware within public software registries, with npm having been found hosting malicious packages in the past year and earlier in the current year.
