Cybersecurity researchers have uncovered a brand new suspicious bundle uploaded to the npm bundle registry that is designed to drop a distant entry trojan (RAT) on compromised methods.
The bundle in query is glup-debugger-log, which targets customers of the gulp toolkit by masquerading as a “logger for gulp and gulp plugins.” It has been downloaded 175 occasions so far.
Software program provide chain safety agency Phylum, which found the bundle, stated the bundle comes fitted with two obfuscated recordsdata that work in tandem to deploy the malicious payload.
“One labored as a type of preliminary dropper setting the stage for the malware marketing campaign by compromising the goal machine if it met sure necessities, then downloading further malware parts, and the opposite script offering the attacker with a persistent distant entry mechanism to manage the compromised machine,” it stated.
Phylum’s nearer examination of the library’s bundle.json file – which acts as a manifest file outlining all metadata related to a bundle – discovered using a take a look at script to run a JavaScript file (“index.js”) that, in flip, invokes an obfuscated JavaScript file (“play.js”).
The second JavaScript file capabilities as a dropper to fetch next-stage malware, however not earlier than working a sequence of checks for community interfaces, particular kinds of Home windows working methods (Home windows NT), and, in an uncommon twist, the variety of recordsdata within the Desktop folder.
“They test to make sure that the Desktop folder of the machine’s residence listing incorporates seven or extra gadgets,” Phylum defined.
“At first look, this may increasingly appear absurdly arbitrary, nevertheless it’s seemingly that this can be a type of person exercise indicator or a solution to keep away from deployment on managed or managed environments like VMs or model new installations. It seems the attacker is concentrating on lively developer machines.”
Assuming all of the checks undergo, it launches one other JavaScript configured within the bundle.json file (“play-safe.js”) to arrange persistence. The loader additional packs within the functionality to execute arbitrary instructions from a URL or an area file.
The “play-safe.js” file, for its half, establishes an HTTP server and listens on port 3004 for incoming instructions, that are then executed. The server sends the command output again to the shopper within the type of a plaintext response.
Phylum described the RAT as each crude and complex, owing to its minimal performance, self-contained nature, and its reliance on obfuscation to withstand evaluation.
“It continues to spotlight the ever-evolving panorama of malware growth within the open supply ecosystems, the place attackers are using new and intelligent methods in an try to create compact, environment friendly, and stealthy malware they hope can evade detection whereas nonetheless possessing highly effective capabilities,” the corporate stated.
