Fortiguard Labs, a cybersecurity research team, has issued a warning about the discovery of malicious packages in the Node Package Manager (npm), the largest JavaScript software registry. These packages have the potential to steal sensitive data, including system and user information, via a webhook or file-sharing link.
The research identified multiple packages with seemingly benign names like “webpack,” “fixedwidthtable,” and “virtualsearchtable.” Some of these packages are capable of exfiltrating critical information, such as Kubernetes configurations, SSH keys, and system fingerprinting details like IP addresses and hostnames.
Scanning for Valuable Data and Configuration Files
Another group of malicious npm packages was found to send HTTP GET requests to specific URLs, scanning for sensitive files and directories containing valuable intellectual property and configuration data. Once found, this information is extracted and uploaded to an FTP server.
These packages capture source code, configuration files, and directories containing sensitive information like application and service credentials. Overall, Fortiguard identified nine groups of malicious npm packages with similar behaviors, primarily hidden within install scripts that run whenever the malicious package is executed.
This discovery underscores the ongoing security challenges associated with public software registries and the need for continuous vigilance and security measures to protect against malicious packages.