Contagious Interview Campaign Spreads Malicious Packages Across Five Ecosystems
Summary
Socket's investigation links Contagious Interview packages across npm, PyPI, Go Modules, crates.io and Packagist. The loaders hide in routine APIs and fetch second-stage payloads; a Windows variant includes RAT capabilities. Some packages were removed after reporting.
Key points
- The investigation links malicious packages published under aliases including golangorg and aokisasakidev across five open-source ecosystems, extending the Contagious Interview campaign.
- Many packages hide loader behavior in routine-looking functions, then retrieve a download URL, fetch a ZIP archive, extract it and execute a platform-specific payload.
- The npm packages use a different approach: they fetch base64-encoded JavaScript and execute it in memory.
- The Windows-focused license-utils-kit package contains a reported RAT with remote shell, keylogging, browser and wallet theft, sensitive-file collection and remote-access deployment capabilities.
- Socket reports that it submitted the packages and associated accounts for takedown; some had been removed while others remained live at the time of writing.
- The article recommends scrutinizing and sandboxing utility packages, pinning dependencies, monitoring unexpected remote downloads and preserving package and maintainer metadata to connect related activity.
Article Details
- Attack Vectors
- Malicious packages published across npm, PyPI, Go Modules, crates.io, and Packagist impersonated legitimate developer tooling.
- Loaders hid execution behind ordinary-looking logging, license-lookup, parser, and update functions in the packages.
- Most non-npm loaders contacted staging infrastructure, retrieved a download URL, downloaded and extracted a ZIP archive, then executed a platform-specific payload.
- Npm packages fetched base64-encoded JavaScript and executed the decoded code in memory within the consuming Node.js process.
- The Windows-focused license-utils-kit variant included RAT capabilities for remote shell execution, keylogging, browser and wallet theft, sensitive-file collection, file uploads, encrypted archiving, and AnyDesk deployment.
- Defensive Notes
- Pin direct and transitive dependencies, and scrutinize newly published or low-download packages before adoption.
- Sandbox suspicious packages before they reach developer workstations or CI systems.
- Monitor for packages that contact remote infrastructure, retrieve download URLs, rewrite cloud-storage links, download archives, decode remote content, or spawn interpreters and binaries.
- Watch for unexpected child processes launched by logging, parsing, lookup, or update functions.
- Preserve registry metadata, maintainer aliases, repository links, staging domains, archive names, extraction paths, and payload names to support faster clustering.
- Report malicious packages and associated accounts to registries and platforms for takedown.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | apachelicense[.]vercel[.]app | Threat-actor-controlled staging domain used by loaders to retrieve download URLs and deliver payloads. |
| DOMAIN | logkit-tau[.]vercel[.]app | Malicious npm package dev-log-core contacted this domain to retrieve and execute remote JavaScript. |
| DOMAIN | logkit[.]onrender[.]com | Domain identified as infrastructure used by malicious npm package variants. |
| DOMAIN | ngrok-free[.]vercel[.]app | Domain identified as infrastructure used by malicious npm package variants. |
aokisasaki1122@gmail[.]com | Maintainer/contact identifier linked by the article to threat-actor personas and package metadata. | |
shiningup1996@gmail[.]com | Maintainer/contact identifier linked by the article to threat-actor personas and package metadata. | |
| IPV4 | 66[.]45[.]225[.]94 | Infrastructure associated with the Windows-focused license-utils-kit variant. |
| SHA256 | 7c5adef4b5aee7a4aa6e795a86f8b7d601618c3bc003f1326ca57d03ec7d6524 | SHA-256 hash of an additional Python-based RAT payload identified by Zscaler. |
| SHA256 | 9a541dffb7fc18dc71dbc8523ec6c3a71c224ffeb518ae3a8d7d16377aebee58 | SHA-256 hash of a Linux second-stage payload reported in connection with malicious PyPI packages. |
| SHA256 | bb2a89001410fa5a11dea6477d4f5573130261badc67fe952cfad1174c2f0edd | SHA-256 hash of a macOS second-stage payload reported in connection with malicious PyPI packages. |
| URL | hxxps[:]//github[.]com/aokisasakidev | GitHub account linked by package and maintainer metadata to the malicious package cluster. |
| URL | hxxps[:]//github[.]com/golangorg | GitHub account identified as a malicious package-publishing persona associated with the cluster. |
| URL | hxxps[:]//github[.]com/maxcointech1010 | GitHub persona described as supporting the threat actor’s broader staging and persona-building activity. |
MITRE ATT&CK
T1005 · Data from Local SystemThe Windows RAT collected browser data, credentials, password-manager contents, wallet data, and sensitive files from compromised systems.T1027.013 · Encrypted/Encoded FileThe Windows license-utils-kit variant contained obfuscated components, and loaders also used encoded payload content.T1036.005 · Match Legitimate Resource Name or LocationPackages impersonated legitimate developer libraries and tooling, including logging and license utilities.T1059.006 · PythonLoaders launched Python interpreters to execute downloaded or decoded code, including through subprocesses and py.exe.T1059.007 · JavaScriptNpm packages decoded base64-encoded JavaScript and executed it in memory with new Function inside the consuming Node.js process.T1071.001 · Web ProtocolsLoaders used HTTP(S) requests to contact staging endpoints and retrieve JSON responses containing download URLs or payload data.T1083 · File and Directory DiscoveryLoaders extracted archives, searched for platform-specific payloads, and executed the located files.T1105 · Ingress Tool TransferPackages downloaded ZIP archives such as ecw_update.zip and retrieved additional platform-specific payloads.T1119 · Automated CollectionThe RAT command handlers included routines for browser theft, sensitive-file collection, and preparing encrypted archives.T1140 · Deobfuscate/Decode Files or InformationThe loaders decoded base64 or otherwise obfuscated remote content before executing it.T1195.001 · Compromise Software Dependencies and Development ToolsThe cluster published malicious packages across five open-source ecosystems to reach developer environments.T1217 · Browser Information DiscoveryThe license-utils-kit RAT included browser-stealer functionality to locate and collect browser data.T1555.003 · Credentials from Web BrowsersThe reported infostealer operation targeted credentials and other data stored in web browsers.T1555.005 · Password ManagersThe reported infostealer operation targeted password-manager contents.T1657 · Financial TheftThe malware targeted cryptocurrency wallet data, which the article identifies as part of the theft operation.
Threat Actors
aokisasakidevA maintainer alias linked through package metadata and repository paths to malicious packages in the same campaign.aokisasakidev1An npm persona whose packages were linked by the article to the malicious cluster; the article reports that associated packages and the account were removed.Contagious InterviewThe article identifies this as the operation associated with a large-scale campaign of malicious packages and the cross-ecosystem loader activity.golangorgA GitHub alias used to publish malicious packages and modules across multiple ecosystems, including the formstash Go module and logtrace Rust crate.maxcointech1010A related GitHub persona that the article says appears to have supported staging and persona-building activity; its role is described as supporting rather than primary package publishing.
Products
AnyDeskThe license-utils-kit Windows variant contains a full RAT with remote shell, keylogging, browser and wallet theft, encrypted archiving, file exfiltration, and AnyDesk deployment capabilities.crates.ioContagious Interview published malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist that impersonated legitimate developer tooling and acted as staged loaders to fetch and execute second-stageGitHubDefensive actions included reporting and takedown requests to registries and GitHub; recommendations emphasize pinning dependencies, sandboxing packages, preserving registry metadata for faster clustering, andGo modulesContagious Interview published malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist that impersonated legitimate developer tooling and acted as staged loaders to fetch and execute second-stagenpmContagious Interview published malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist that impersonated legitimate developer tooling and acted as staged loaders to fetch and execute second-stagePackagistContagious Interview published malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist that impersonated legitimate developer tooling and acted as staged loaders to fetch and execute second-stagePyPIContagious Interview published malicious packages across npm, PyPI, Go Modules, crates.io, and Packagist that impersonated legitimate developer tooling and acted as staged loaders to fetch and execute second-stage