SafeDep Links 36 Malicious npm Packages to Campaign Targeting Strapi Users and Guardarian
Summary
SafeDep says 36 malicious npm packages across four accounts delivered payloads for credential theft, reverse shells and other attacks. The firm assesses the campaign targeted Strapi users and Guardarian; it advises affected users to rotate credentials.
Key points
- SafeDep reported 36 malicious npm packages published across four accounts as part of one campaign.
- Payloads were capable of Redis code execution, Docker container escape, credential harvesting, reverse-shell deployment and persistence.
- One payload reportedly injected cron jobs and SSH keys, deployed webshells and reverse shells, and exfiltrated a Guardarian API module.
- Other payloads reportedly sought Elasticsearch and wallet credentials, targeted PostgreSQL databases, and exfiltrated Strapi configurations.
- SafeDep assesses that the campaign targeted Guardarian, citing database probing, use of a Guardarian API module and searches for specific wallet files.
- SafeDep recommends that users who installed the packages rotate database passwords, API keys, JWT secrets and other stored credentials.
Article Details
- Event Type
- Supply-chain attack involving 36 malicious NPM packages published across four accounts.
- Impact
- According to SafeDep, the packages delivered payloads capable of Redis code execution, Docker container escape, credential theft, reverse-shell deployment, and data exfiltration. SafeDep says the campaign targeted Guardarian, citing database probing, use of a Guardarian API module, and targeting of specific wallet files. The article does not confirm that the payloads achieved these outcomes.
MITRE ATT&CK
T1053.003 · CronOne payload injected crontab entries.T1210 · Exploitation of Remote ServicesThe campaign included a payload that exploited Redis instances for code execution.T1552.001 · Credentials In FilesPayloads searched for wallet/key files and read Elasticsearch and wallet credentials.T1611 · Escape to HostA payload was designed to escape Docker containers and write shells to host directories.
Products
Dockeras part of a single campaign are delivering various malicious payloads capable of Redis code execution, Docker container escape, credential harvesting, and reverse shell deployment.ElasticsearchAnother payload was designed to escape Docker containers via overlay filesystem discovery, write shells to host directories, launch a reverse shell, and read Elasticsearch and wallet credentials.Node.jsAn open source headless CMS built on Node.js, Strapi allows developers to create websites and mobile applications and generate APIs, enabling them to use their favorite tools and frameworks.npmA threat actor has targeted the Strapi ecosystem in a fresh supply chain attack involving 36 malicious NPM packages, according to supply chain security firm SafeDep.PostgreSQLOther payloads were observed deploying reverse shells, harvesting credentials, targeting PostgreSQL databases, searching for wallet/key files, exfiltrating Strapi configurations, and deploying persistent implants.Redisacross four accounts as part of a single campaign are delivering various malicious payloads capable of Redis code execution, Docker container escape, credential harvesting, and reverse shell deployment.StrapiA threat actor has targeted the Strapi ecosystem in a fresh supply chain attack involving 36 malicious NPM packages, according to supply chain security firm SafeDep.