Cybersecurity experts have found a new set of harmful npm packages that attack users of Alibaba developer tools via cross-platform RAT (Remote Access Trojan). This was part of an advanced, specific software supply chain attack against Chinese-speaking environments.
About the packages
Lib-mtop is an unscoped package with the same name as the private Alibaba package as @ali scope. Experts have not confirmed if this was due to the project developer going rogue or takeover of the maintainer account.
“Ch4ce,” the same maintainer account which presently redirects to a ‘not found’ error on npmjs[.]com also posted four other packages: local-config-parser, aone-kit-cli, aone-kit, and aone-sandbox. Three of these are empty wrappers carrying the same name as private, @ali-scoped packages, “which they declare as a dependency in the package.json file,” said Socket security researcher.
Attack tactic
The local-confi-parser package uses a genuine JSON configuration file parser, but shows dependencies that are posted from other npm user accounts. Together, they provide a channel for an advanced RAT attacking developers who may be working in organizations related with the Alibaba group.
Particularly, the infected loader functionality is divided and deployed into various packages sent to the victims. "When such a package is installed in an environment that has access to impersonated, scoped private packages, the dependency resolution works as expected, with a little extra functionality delivered through additional dependencies that get installed," Socket said.
Experts found 10 top-layer lure packages that depend on “smart-config-manager,” which works similar to a middle-layer bridge that links them to harmful payloads consisting of the loader logic. A low layer package continues to reach out to a GitHub repository to extract and store a rule engine configuration for use to run a malicious payload and contacts a remote server for fetching secondary malware.
What sets this attack apart?
A unique thing about the campaign is that the rule engine uses the vm module to implement the last phase and run the payload according to the target’s OS. The payload is fetched from a domain that mimics Alibaba to look natural and escape detection.
The final payload is an advanced backdoor integrated with arbitrary file upload and download, comprehensive command execution, payload staging, lateral movement functions and host reconnaissance. The payload can also inject infected code into enterprise apps like Qoder, DingTalk, and Wukong.
"The goal of the campaign seems to be industrial espionage. While the number of downloads for the malicious packages is not significant, the impact of the campaign is hard to evaluate, because of the targeted nature and lateral-spread capabilities of the final-stage payload,” Socket said.
Read the original article: