Critical npm Supply Chain Attack Delivers Cross-Platform RAT/Infostealer

A widespread and critical supply chain attack has been identified, involving nearly 800 malicious packages published to the npm registry. This sophisticated campaign delivers a cross-platform Remote Access Trojan (RAT) and infostealer, actively targeting Windows, macOS, and Linux operating systems. Researchers at OpenSourceMalware first reported this activity, with Sonatype tracking the campaign under the moniker “Flooding Dropper.” The incident highlights a significant threat to the software supply chain, impacting developers and organizations relying on the npm ecosystem, as detailed by The Hacker News.

The threat actors behind this campaign utilize randomly generated or typo-squatted package names to distribute their malicious payloads. Unlike common npm supply chain attacks that exploit preinstall or postinstall lifecycle hooks, these packages employ a deceptive README file. This README instructs developers to explicitly load the package using the require() function, which is a built-in Node.js function for importing modules. This method allows the malicious code to execute as part of the application’s runtime, circumventing typical security measures designed to detect automated execution during installation.

Technical Analysis of the npm Supply Chain Attack

The infection chain initiated by these malicious npm packages leads to the execution of a downloader named WEL1DROPPER. Upon execution, WEL1DROPPER first identifies the host operating system and processor architecture. This reconnaissance phase enables it to fetch a compatible second-stage payload from one of three Cloudflare Workers hosts. This multi-platform capability ensures a broad attack surface across different development environments.

Multi-Stage Payload Delivery and Evasion Tactics

Should the initial HTTPS-based downloads from Cloudflare Workers fail, the malware employs a sophisticated fallback mechanism. It switches to a platform-specific domain, wel1[.]ru, and leverages DNS TXT records to obtain subsequent payload stages. According to OpenSourceMalware, the process involves requesting a TXT record to determine the number of payload chunks (between 1 and 2,000), then requesting numbered TXT records, joining the returned strings, and Base64-decoding them into a binary buffer. This technique makes the payload retrieval stealthier and more resilient against network filtering.

The final stage involves writing the decoded payload to a temporary folder and executing it. On Linux and macOS systems, this is achieved using /bin/sh, while Windows systems use cmd.exe. The malware then launches the payload as a detached process, further complicating detection and termination.

• Windows-Specific Behaviors: The Windows version of the payload incorporates advanced evasion techniques. It attempts to patch Event Tracing for Windows (ETW) and the Antimalware Scan Interface (AMSI) to interfere with monitoring and analysis tools. It also checks for the presence of sandboxes and virtual environments. For persistence, it establishes a Registry Run key and creates a scheduled task. This variant downloads an encrypted payload, /pkg/update_win.exe, and executes it.
• macOS-Specific Behaviors: The macOS infection chain mirrors the Windows version in its sophisticated approach. It performs similar checks for debuggers and and analysis artifacts before retrieving a compatible payload, /pkg/beacon_mac.bin, from a remote server. If this primary method fails, it also resorts to the aforementioned DNS TXT delivery. Persistence is achieved through a LaunchAgent, and the executable is subsequently started as a detached process.
• Linux-Specific Behaviors: The Linux sample is distributed as an UPX-packed ELF binary. It is configured to download auxiliary payloads from another Cloudflare Worker URL, oob-worker[.]cf99-9b3.workers[.]dev. This ultimately leads to the deployment of Sliver, an open-source command-and-control (C2) framework, giving attackers extensive control over compromised systems.

The malicious packages also include a file named lib/telemetry.js. This file implements what appears to be a plausible telemetry SDK but contains the same downloader logic. This “oversized telemetry implementation” is intended to add noise and make the malicious behavior blend in with legitimate profiling or analytics functionality, hindering quick reviews and detection.

Initial analysis, based on domains like tcsbank[.]ru and cloudpayments[.]ru found in the macOS payload, suggests the campaign could be targeting Russian financial institutions and mobile payments. This campaign is also suspected to be an evolution of a previously identified dependency confusion campaign, codenamed Moika, which appeared in April and involved over 250 npm packages. Palo Alto Networks Unit 42 has also documented multiple campaigns targeting the npm and PyPI repositories, underscoring the escalating threat of software supply chain attacks.

Mitigating npm Supply Chain Attack Risks

Defending against sophisticated attacks like the Flooding Dropper requires a multi-layered approach to Software Supply Chain Security. Organizations and developers must prioritize proactive measures to identify and neutralize threats before they can impact production environments.

Key Recommendations for Detecting WEL1DROPPER Malware and Preventing Future Attacks:

• Strict Dependency Vetting: Implement rigorous processes for vetting all third-party npm package dependencies, especially new ones. Scrutinize the package’s origin, author reputation, and historical activity before integration.
• Code Review and Static Analysis: Conduct thorough code reviews and utilize static application security testing (SAST) tools. Look for suspicious require() calls or unusual lib/telemetry.js implementations that might hide malicious downloader logic.
• Network Monitoring: Monitor outbound network connections from build systems and runtime environments. Look for connections to suspicious domains, including Cloudflare Workers hosts used by WEL1DROPPER, wel1[.]ru, and oob-worker[.]cf99-9b3.workers[.]dev. DNS query monitoring for unusual TXT record requests is also crucial.
• Endpoint Detection and Response (EDR): Deploy EDR solutions capable of detecting WEL1DROPPER activity, such as attempts to patch ETW or AMSI, creation of suspicious Registry Run keys, scheduled tasks, or LaunchAgents for persistence. Monitor for unusual process execution, especially those involving /bin/sh or cmd.exe launching unexpected binaries from temporary directories.
• Developer Education: Educate developers on the risks associated with blindly following README instructions, particularly those involving require() calls for new or unknown packages. Emphasize the importance of understanding the code being imported.
• Dependency Management Tools: Leverage automated dependency analysis tools that can flag outdated, vulnerable, or potentially malicious packages within your projects. This helps in managing npm supply chain attack mitigation effectively.

By adopting these preventative and detection strategies, organizations can significantly reduce their exposure to similar npm supply chain threats and safeguard their development ecosystems.

Related: Shai-Hulud Infostealer Surfaces in Malicious npm Package Campaign, Jscrambler npm Package Backdoored with Infostealer Malware