200 malicious packages targeting Azure developers removed by npm
The attacker created dozens of malicious counterparts that had the same name as existing @azure scope packages
More than 200 malicious packages that attempted to target Azure developers to steal personal identifiable information have been removed from npm Javascript package repository.
Details of these malicious packages were published in a new report on Wednesday by Andrey Polkovnychenko and Shachar Menashem, researchers from DevOps security firm JFrog, who said the entire set of malicious packages was revealed to the npm maintainers just two days after they were added by threat actors, leading to their quick removal.
Because npm packages are used in a huge number of web-facing applications, exploiting them means a large playing field for attackers. According to cyber security analysts, this level of activity also enables threat actors to undertake a variety of attacks on software supply chains.
The JFrog researchers said that many of their automatic analysers recently began flagging a set of packages in the npm registry. As of 21st March 2022, this specific set of packages had grown from about 50 packages to more than 200 over the course of a few days.
After carefully reviewing several of these packages, it became clear that this was a targeted attack on the entire @azure npm scope. The attacker used an automated script to create accounts and upload malicious packages that covered the entirety of that scope.
The actor created dozens of malicious counterparts that had the same name as their existing @azure scope packages but without the scope name (for example, @azure/core-tracing vs. core-tracing).
Such an attack is known as 'typosquatting' - a kind of phishing attack in which inconspicuous alternations are made to an email address, a file, or a website address to make it look like a legitimate service or content.
Malicious typosquatting packages on npm prey on the naive user or a developer making a slight typographical error, eventually leading to them downloading the malicious package instead of the one they had intended to install.
In one such case, the JFrog researchers identified a malicious typosquat named "core-tracing", in imitation of the correct command npm install @azure/core-tracing.
"The attacker is relying on the fact that some developers may erroneously omit the @azure prefix when installing a package," the researchers said.
At this time, the malicious payload of these packages has been identified as stealers of personally identifiable information (PII).
Once the package is installed, the malicious code runs automatically and leaks the following information:
- Directory listing of some specific directories
- Username
- Home directory of the user
- Current working directory
- IP addresses of configured DNS servers
- IP addresses of all network interfaces
In addition to targeting @azure scope, the researchers found that the attacker also attempted to target the following scopes: @azure-tests, @azure-rest, @azure-tools and @cadl-lang.
All the malicious packages had high version numbers, suggesting efforts at dependency confusion attacks.
Because the packages were discovered and reported very quickly, each package only averaged about 50 downloads.
There has been a huge rise in supply chain attacks in recent months, especially through the npm and PyPI package repositories. Because of this, researchers think that more inspection and mitigation measures should be put in place.
Last month, JFrog researchers said they had discovered and assisted in the removal of another batch of 25 malicious JavaScript libraries that had made their way to the official npm package registry with the intent of stealing Discord tokens and environment variables from compromised systems.
Seventeen of them were intended to steal Discord access tokens from machines where malicious code was run.
Three packages also enabled attackers to execute their own commands on the user's machine using Python code or shell commands.