Analysis of an exploited npm package
summary
Ownership moves to an attacker who, over 77 days and through a dependency update pulled by projects with ~1.2M weekly downloads, delivers three staged payloads. Bootstrapper decrypts using package description as the AES key and compiles stage two only when run as an npm script, stage two injects into Copay Cordova build by placing code into a dependency during the build, and stage three harvests private keys from wallets >=100 BTC and exfiltrates them. Investigation uses all-the-packages streaming, JS parsing and sandboxed VMs; discovery lag is 48 days.
AI-written summary · about
chapters (16)
- 0:00Who am I
- 0:44What is Shape
- 1:31Event Stream
- 2:49Why
- 3:59Semantic Versioning
- 5:18Note
- 6:04Dependencies
- 6:55What did it do first
- 8:10How was it discovered
- 9:16The payload
- 13:01Recap
- 13:38All the packages
- 14:22Decrypting
- 16:05Injection
- 18:37Final payload
- 20:19The bad news
related talks
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
30mSnow Nor Rain Nor Dependency Confusion: How to...
23mProtecting Your npm Dependencies
32mBreaking the Chain: Advanced Offensive Strategies in Software Supply Chain
34mThe Simple, Yet Lethal, Anatomy of a Software Supply Chain Attack
29mAll your packages are belong to us - Protecting your npm dependencies
35mSupply Chain Attacks: Focused on NPM attacks