A set of fake npm packages discovered on the Node.js repository has been found to share ties with North Korean state-sponsored actors, new findings from Phylum show.
The packages are named execution-time-async, data-time-utils, login-time-utils, mongodb-connection-utils, and mongodb-execution-utils.
One of the packages in question, execution-time-async, masquerades as its legitimate counterpart execution-time, a library with more than 27,000 weekly downloads. Execution-time is a Node.js utility used to measure execution time in code.
It "actually installs several malicious scripts including a cryptocurrency and credential stealer," Phylum said, describing the campaign as a software supply chain attack targeting developers. The package was downloaded 302 times since February 4, 2024, before being taken down.
In an interesting twist, the threat actors made efforts to conceal the obfuscated malicious code in a test file, which is designed to fetch next-stage payloads from a remote server, steal credentials from web browsers like Brave, Google Chrome, and Opera, and retrieve a Python script, which, in turn, downloads other scripts -
- ~/.n2/pay, which can run arbitrary commands, download and launch ~/.n2/bow and ~/.n2/adc, terminate Brave and Google Chrome, and even delete itself
- ~/.n2/bow, which is a Python-based browser password stealer
- ~/.n2/adc, which installs AnyDesk on Windows
Phylum said it identified comments in the source code ("/Users/ninoacuna/") that made it possible to track down a now-deleted GitHub profile with the same name ("Nino Acuna" or binaryExDev) containing a repository called File-Uploader.
Present within the repository were Python scripts referencing the same IP addresses (162.218.114[.]83 – subsequently changed to 45.61.169[.]99) used to fetch the aforementioned Python scripts.
It's suspected that the attack is a work in progress, as at least four more packages with identical features have made their way to the npm package repository, attracting a total of 325 downloads -
- data-time-utils - 52 downloads starting from February 15
- login-time-utils - 171 downloads starting from February 15
- mongodb-connection-utils - 51 downloads starting from February 19
- mongodb-execution-utils - 51 downloads starting from February 19
Connections to North Korean Actors Emerge
Phylum, which also analyzed the two GitHub accounts that binaryExDev follows, uncovered another repository known as mave-finance-org/auth-playground, which has been forked no less than a dozen times by other accounts.
While forking a repository in itself is not out of the ordinary, an unusual aspect of some of these forked repositories were that they were renamed as "auth-demo" or "auth-challenge," raising the possibility that the original repository may have been shared as part of a coding test for a job interview.
The repository was later moved to banus-finance-org/auth-sandbox, Dexbanus-org/live-coding-sandbox, and mave-finance/next-assessment, indicating attempts to actively get around GitHub's takedown attempts. All these accounts have been removed.
What's more, the next-assessment package was found to contain a dependency "json-mock-config-server" that's not listed on the npm registry, but rather served directly from the domain npm.mave[.]finance.
It's worth noting that Banus claims to be a decentralized perpetual spot exchange based in Hong Kong, with the company even posting a job opportunity for a senior frontend developer on February 21, 2024. It's currently not clear if this is a genuine job opening or if it's an elaborate social engineering scheme.
The connections to North Korean threat actors come from the fact that the obfuscated JavaScript embedded in the npm package overlaps with another JavaScript-based malware dubbed BeaverTail that's propagated via a similar mechanism. The campaign was codenamed Contagious Interview by Palo Alto Networks Unit 42 in November 2023.
Contagious Interview is a little different from Operation Dream Job – which is linked to the Lazarus Group – in that it's mainly focused on targeting developers through fake identities in freelance job portals to trick them into installing rogue npm packages, Michael Sikorski, vice president and CTO of Palo Alto Networks Unit 42, told The Hacker News at the time.
One of the developers who fell victim to the campaign has since confirmed to Phylum that the repository is shared under the guise of a live coding interview, although they said they never installed it on their system.
"More than ever, it is important for both individual developers as well as software development organizations to remain vigilant against these attacks in open-source code," the company said.
