Compromised NPM Credentials Used to Publish Malicious Jscrambler Packages

Summary

Attackers used NPM publishing credentials to release malicious Jscrambler package versions containing an installation hook and Rust information stealers. NPM data showed 1,479 downloads before the versions were deprecated; Jscrambler revoked credentials and advised user

Key points

• Jscrambler said its investigation indicated an attacker used NPM publishing credentials to release modified package versions beginning July 11.
• Malicious versions 8.16, 8.17, 8.18, and 8.20 included a preinstall hook and platform-specific binaries; version 8.22 was the first clean version.
• Related Jscrambler webpack, gulp, grunt, and metro packages were also affected at specified versions.
• NPM data showed the malicious versions were downloaded 1,479 times before they were deprecated and replaced.
• Socket reported that the Rust binaries targeted credentials and secrets, wallets, developer tools, messaging apps, browsers, and OS keyrings, and attempted privilege escalation and persistence.
• Socket observed harvested information being sent over TLS; the malware also made requests to cloud and orchestration APIs using stolen credentials.
• Jscrambler said it revoked and rotated relevant credentials, passwords, and secrets and added publishing controls; users were advised to remove affected versions, scan systems, and rotate credentials, tokens, and API keys.

MITRE ATT&CK

Vendors

Products