An NPM supply-chain attack dating back to December 2021 used dozens of malicious NPM modules containing obfuscated Javascript code to compromise hundreds of downstream desktop apps and websites.
As researchers at supply chain security firm ReversingLabs discovered, the threat actors behind this campaign (known as IconBurst) used typosquatting to infect developers looking for very popular packages, such as umbrellajs and ionic.io NPM modules.
If fooled by the very similar module naming scheme, they would add the malicious packages designed to steal data from embedded forms (including those used for sign-in) to their apps or websites.
For instance, one of the malicious NPM packages used in this campaign (icon-package) has over 17,000 downloads and is designed to exfiltrate serialized form data to several attacker-controlled domains.
IconBurst “relied on typo-squatting, a technique in which attackers offer up packages via public repositories with names that are similar to — or common misspellings of — legitimate packages,” said Karlo Zanki, a reverse engineer at ReversingLabs.
“Furthermore, similarities between the domains used to exfiltrate data suggest that the various modules in this campaign are in the control of a single actor.”
Some malicious modules still available for download
While the ReversingLabs team reached out to the NPM security team on July 1, 2022, to report its findings, some IconBurst malicious packages are still available on the NPM registry.
“While a few of the named packages have been removed from NPM, most are still available for download at the time of this report,” Zanki added.
“As very few development organizations have the ability to detect malicious code within open source libraries and modules, the attacks persisted for months before coming to our attention.”
Even though the researchers could compile a list of malicious packages used in the IconBurst supply-chain attack, its impact is yet to be determined, seeing that there’s no way to know how much data and credentials were stolen via infected apps and web pages since December 2021.
The only metrics available at the time are the number of times each malicious NPM module has been installed, and ReversingLabs’ stats are quite startling.
“While the full extent of this attack isn’t yet known, the malicious packages we discovered are likely used by hundreds, if not thousands of downstream mobile and desktop applications as well as websites,” Zanki said.
“Malicious code bundled within the NPM modules is running within an unknown number of mobile and desktop applications and web pages, harvesting untold amounts of user data.
“The NPM modules our team identified have been collectively downloaded more than 27,000 times.”
