More packages poisoned in npm attack, but would-be crypto thieves left pocket change

During the two-hour window on Monday in which hijacked npm versions were available for download, malware-laced packages reached one in 10 cloud environments, according to Wiz researchers. But crypto-craving crims did little more than annoy defenders.

As of Tuesday, the supply-chain attack remains active, and its scope extends beyond the original 18 infected Qix packages to now include five additional compromised DuckDB and coveops/abi packages, according to JFrog.

Wiz warns organizations to assume “malicious versions of popular packages are still available for download and might be automatically included in development pipelines.” 

This latest supply-chain attack “highlights how fragile the modern JavaScript ecosystem is, where half of the codebase is dependent on single-line utilities maintained by a single developer,” JFrog researcher Andrey Polkovnichenko wrote.

As a refresher, here’s what happened on Monday. Qix developer Josh Junon, after being duped by a phishing email, inadvertently authorized a reset of the two-factor authentication protecting his npm account. This allowed criminals to backdoor popular npm packages, including debug and chalk, with cryptocurrency-stealing malware. 

Those 18 compromised packages collectively account for about two billion downloads per week.

The good news is that, despite having the social-engineering skills to potentially pull off one of the largest supply-chain-attacks-slash-crypto-heists in history, the miscreants massively fumbled it, and as of mid-day Tuesday, the attackers had only stolen about $925 in cryptocurrency, according to on-chain analytics firm Arkham.

“In our view, the true impact of this campaign has been a ‘denial-of-service’ attack on the industry, wasting countless hours of work in order to ensure the risk has been mitigated,” Wiz researchers Hila Ramati, Gal Benmocha, and Danielle Aminov said Tuesday, noting that after the malicious versions were published, the compromised code could be found in at least 10 percent of cloud environments in bundles or assets.

And it should serve a couple of important lessons for defenders and developers alike. 

“This attack shows how fragile the software supply chain can be: even tiny utilities like chalk (used just to color console output) can become high-impact attack vectors,” Tyler Moffitt, senior security analyst at OpenText Cybersecurity, told The Register.

Despite all the newer, sexier threats posed by AI (It’s developing ransomware and extorting victims for hundreds of thousands of dollars!), attackers are likely going to choose the easy button. 

“Phishing and credential theft remain the easiest path for attackers to compromise trusted infrastructure,” Moffitt said. ®

READ MORE HERE