Self-Spreading npm Supply-Chain Attack Steals Developer Credentials
Summary
Researchers reported compromised Namastex Labs packages whose malware steals developer secrets and attempts to spread through npm and PyPI. Similarities to TeamPCP’s CanisterWorm were noted, but attribution remains unconfirmed.
Key points
- Researchers from Socket and StepSecurity identified compromised Namastex Labs npm packages, including pgserve.
- Injected code collects tokens, API keys, SSH keys, cloud and CI/CD credentials, and other sensitive data.
- The malware can use npm publish tokens to inject itself into packages those tokens can publish, then republish them at higher versions.
- Researchers said the attack can also target Python packages through PyPI when credentials are available.
- The techniques resemble TeamPCP’s CanisterWorm, but researchers could not confidently attribute the attack to that group.
- Recommended actions include removing affected package versions, rotating potentially exposed secrets, and auditing internal mirrors, artifacts, and caches.
Article Details
- Event Type
- Self-propagating npm supply-chain attack involving compromised Namastex Labs packages.
- Impact
- Researchers from Socket and StepSecurity report that malicious package versions steal developer credentials and secrets, including tokens, API keys, SSH keys, cloud and CI/CD credentials, and data from browsers and cryptocurrency wallets. The code can republish itself to packages accessible with stolen npm publish tokens and may spread to Python packages when PyPI credentials are found. Researchers noted similarities to TeamPCP’s CanisterWorm attacks but said they could not confidently attribute this attack to TeamPCP.
MITRE ATT&CK
T1195.002 · Compromise Software Supply ChainMalicious code was injected into npm packages and distributed through compromised package releases.T1528 · Steal Application Access TokenThe attack harvests tokens, including tokens used to publish packages.T1552.001 · Credentials In FilesThe code searches environment variables and the ~/.npmrc file for publish tokens and other secrets.T1555.003 · Credentials from Web BrowsersThe code attempts to extract sensitive data stored in Chrome and Firefox.