Embedded malware in RC (NPM package)

Note how the referenced Virustotal result has 40+ detections [1]. I'm still wondering why info like this isn't used by Pypi and NPM. Chocolatey has Virustotal integration for all releases.

And it's not like Virustotal is the only option, there is Cape [2] for dynamic execution, Metadefender, and Intezer Analyze just to name a few.

Really confusing for such a vital supply chain component to be this easily abused.

One of the highlights is when someone recently used NPM to spread ransomware via a fake Roblox API package.[3]

[1] https://www.virustotal.com/gui/file/26451f7f6fe297adf6738295...

[2] https://github.com/kevoreilly/CAPEv2

[3] https://www.reddit.com/r/programming/comments/qgz0em/fake_np...

Re: Embedded malware in RC (NPM package)

#5

Post by qwerty2021 » Fri, Nov 05, 2021, 6:07 PM UTC

I checked the readme of both those packages and I can't for the life of me understand why would anyone use either of them.

Why the fuck do all these leftpad is-even hello-world tic-tac-toe packages have millions of downloads?

Re: Embedded malware in RC (NPM package)

#6

Post by tyingq » Fri, Nov 05, 2021, 6:10 PM UTC

qwerty2021 wrote: post #5

I checked the readme of both those packages and I can't for the life of me understand why would anyone use either of them. Why the fuck do all these leftpad is-even hello-world tic-tac-toe packages have millions of downloads?

Chained dependencies? If you can fool one popular package to depend on you, you ride their coattails.

And perhaps some faked download numbers to lend an air of authenticity.

Re: Embedded malware in RC (NPM package)

#7

Post by havkd » Fri, Nov 05, 2021, 6:16 PM UTC

tyingq wrote: post #6

qwerty2021 wrote: post #5

I checked the readme of both those packages and I can't for the life of me understand why would anyone use either of them. Why the fuck do all these leftpad is-even hello-world tic-tac-toe packages have millions of downloads?

Chained dependencies? If you can fool one popular package to depend on you, you ride their coattails. And perhaps some faked download numbers to lend an air of authenticity.

Maybe we need to hold the popular packages accountable for stuff like this.

Re: Embedded malware in RC (NPM package)

#8

Post by iancarroll » Fri, Nov 05, 2021, 6:23 PM UTC

schleck8 wrote: post #4

And yet again, twice in a row this time. Note how the referenced Virustotal result has 40+ detections [1]. I'm still wondering why info like this isn't used by Pypi and NPM. Chocolatey has Virustotal integration for all releases. And it's not like Virustotal is the only option, there is Cape [2] for dynamic execution, Metadefender, and Intezer Analyze just to name a few. Really confusing for such a vital supply chain…

It’s not clear that this would be useful; at least for the coa package, the DLL was downloaded dynamically via a script, so NPM would not have been able to detect it unless the script itself was flagged. Not sure what Chocolatey does, but it’s also hard to threshold on VirusTotal when there are a lot of FPs by random vendors.

Re: Embedded malware in RC (NPM package)

#9

Post by afavour » Fri, Nov 05, 2021, 6:24 PM UTC

qwerty2021 wrote: post #5

I checked the readme of both those packages and I can't for the life of me understand why would anyone use either of them. Why the fuck do all these leftpad is-even hello-world tic-tac-toe packages have millions of downloads?

Command line argument parsing and config loading both seem like very sensible library abstractions to me. This isn’t leftpad.

Re: Embedded malware in RC (NPM package)

#10

Post by tolmasky » Fri, Nov 05, 2021, 6:30 PM UTC

If you're interested in preventing this sort of thing, I'd appreciate comments on this [RFC](https://github.com/npm/rfcs/pull/488) I just submitted to npm to make install scripts opt-in instead of default behavior. While of course not perfect, this simple change would certainly go a long way in increasing the difficulty in creating these sorts of attacks, as right now as long as a computer even installs the packages in question, not even running any code in the package, the malicious program has a chance at running.

RFC: https://github.com/npm/rfcs/pull/488