After recent reports of security researcher Alex Birsan compromising large companies like Microsoft, Apple, Paypal and Netflix through the NPM package repository, Sonatype has spotted over 275 new malicious packages copying Birsan’s concept.
NPM is an open repository to manage JavaScript packages that developers can easily add as a dependency to their project. On top of having the public repository hosted at npmjs.com, organizations may also elect to host their own private repository to manage their closed-source code just as easily. The problem Birsan discovered is called “dependency confusion” and relies on publishing packages to the public repositories that have the same name an organization may be using in their private repository. What he realized was that when a package with the same name existed in the public and private repositories, NPM prioritized the public repository by default and would download the packages he published.
Code for the package “shopify-cloud,” a malicious package identified in the Sonatype report, is seen setting DNS servers to an attacker-controlled source. Another package identified by BleepingComputer also set DNS to an attacker-controlled source but left comments from Birsan’s proof of concept code, including his email address and Twitter handle. Birsan confirmed that he did not post the new packages, and that every NPM package he published has been under his clearly identified account and all of his published packages collect the same minimally invasive information. He suggested that other researchers or threat actors are likely copying the concept that he popularized in order to earn bug bounty rewards or in attempts to actually compromise targets.
Analyst Notes
Developers should pay careful attention to the packages used in their projects for any dependencies that allow packages to be pulled from public repositories. These packages are often added to projects without ever being checked for malicious code or other un-wanted behaviors. In the case of NPM for JavaScript projects, dependency confusion was causing the project to download the wrong package unbeknownst to the developers. To learn how to manage private and public NPM repositories, see the NPM documentation here. NPM’s documentation shows how to separate profiles and scopes, allowing for private repositories to be used while still having access to public packages.
Source: https://www.bleepingcomputer.com/news/security/copycats-imitate-novel-supply-chain-attack-that-hit-tech-giants/
https://blog.sonatype.com/sonatype-spots-150-malicious-npm-packages-copying-recent-software-supply-chain-attacks
https://docs.npmjs.com/configuring-your-registry-settings-as-an-npm-enterprise-user
