🚨 The JFrog Security Research team has recently uncovered 16 obfuscated malicious packages circulating in the npm ecosystem 🚨
These malicious packages fall into three distinct categories:
9 LIVE Info-Stealers:
8 packages that are designed to exfiltrate information to a specific endpoint: dependency-confusion-research[.]pescesean[.]workers[.]dev:443
Despite their relatively simple logic, several employ anti-debugging and anti-analysis techniques.
The ninth package is a more advanced information stealer, exfiltrating cryptocurrency-related files such as wallets and secrets to a specific Telegram bot.
2 C2 Agents:
These packages function as command-and-control agents with potentially interesting capabilities. They appear to have been uploaded as test artifacts, even including the word “test” in their package names.
Both rely on a hardcoded C2 endpoint: hxxps[:]//d3byjvkj50cpgf[.]cloudfront[.]net.
5 Crypto Utility Libraries (Exfiltrators):
Masquerading as legitimate cryptocurrency utility libraries, these packages are primarily focused on data exfiltration.
They send sensitive information, including base64-decoded data and PEM files, directly to a Telegram channel.
All of these malicious packages are already detected in JFrog Xray and Curation under the Xray IDs listed below:
Info stealers:
teslaone - XRAY-934142
ern-picking2-api - XRAY-934150
converse-rn-lib - XRAY-934155
picking-miniapp - XRAY-934138
react-native-expofp - XRAY-934152
acuitymobileapp - XRAY-934137
digital-music-dynmsg-ribbon - XRAY-934145
wallet-icon-font - XRAY-933727
ftm-noderpc - XRAY-934153
C2 Agents:
sra-test-test - XRAY-934139
rnv-workflow-test - XRAY-934143
Masquerading crypto packages:
raydium-bs58 - XRAY-934148
base-x-64 - XRAY-934144
ethers-wallet-latest - XRAY-932604
etherwallets-latest - XRAY-932600
base60-58x - XRAY-932601- XRAY-934139
rnv-workflow-test - XRAY-934143