cyber.hendryadrian.com
Threat Research · thehackernews.com

36 Malicious npm Packages Abuse Redis and PostgreSQL to Target Strapi Installations

· Original article ↗

Summary

SafeDep identified 36 malicious npm packages impersonating Strapi plugins. Their install hooks attempted Redis and PostgreSQL exploitation, credential theft, and persistent access, with cryptocurrency-related data among the targets. Users who installed them are advised,

Key points

  • The packages mimicked Strapi v3 plugins and ran malicious postinstall scripts automatically during npm installation, with the installing user's privileges.
  • Four sock-puppet accounts published the 36 packages within 13 hours; the packages shared a “strapi-plugin-” naming pattern and lacked legitimate metadata.
  • Payloads included attempts to exploit Redis, escape Docker containers, deploy reverse shells, and collect environment variables, secrets, and database connection strings.
  • Later payloads used hard-coded PostgreSQL credentials to query Strapi-specific tables and search for cryptocurrency-related data.
  • The packages attempted to access Guardarian databases; the article says this could indicate prior access to the data but does not establish how it was obtained.
  • The campaign's focus on cryptocurrency-related assets raises the possibility of a targeted attack against a cryptocurrency platform.
  • Users who installed any of the packages are advised to assume compromise and rotate credentials.

Article Details

Attack Vectors
  • Thirty-six npm packages impersonating Strapi v3 plugins ran malicious postinstall scripts automatically when installed.
  • Payloads exploited locally accessible Redis instances to execute commands, create cron jobs, and deploy shell payloads; some also attempted to escape Docker containers.
  • Packages used hard-coded PostgreSQL credentials to query Strapi-specific tables and cryptocurrency-related data, and attempted to access Guardarian databases.
  • Additional payloads harvested environment variables, credentials, configuration data, container secrets, cryptographic keys, and cryptocurrency wallet files, and deployed persistent reverse shells or implants.
Defensive Notes
  • Users who installed any of the identified packages should assume compromise and rotate all credentials.

Indicators of compromise

TypeIndicatorContext
IPV4216[.]126[.]237[.]71The article says the RAT delivered by the malicious express-session-js package connected to this address.

MITRE ATT&CK

T1005 · Data from Local SystemPayloads searched systems for cryptocurrency wallet files and extracted Redis database data.T1016 · System Network Configuration DiscoveryA reconnaissance payload mapped network topology.T1021.004 · SSHA payload wrote a PHP web shell and a Node.js reverse shell to Strapi’s public uploads directory via SSH.T1053.003 · CronA payload added a crontab entry to download and execute a shell script every minute.T1059.004 · Unix ShellThe payloads used shell scripts and reverse shells to execute commands.T1059.006 · PythonA payload launched a Python reverse shell on port 4444.T1059.007 · JavaScriptThe packages embedded malicious postinstall scripts that ran during npm installation.T1078 · Valid AccountsA payload used hard-coded credentials to connect to PostgreSQL databases.T1105 · Ingress Tool TransferThe cron job downloaded a shell script from a remote server.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious npm packages impersonated Strapi plugins to distribute payloads through the package ecosystem.T1213.006 · DatabasesA payload used hard-coded credentials to query PostgreSQL and Strapi-specific tables for secrets and cryptocurrency-related data.T1505.003 · Web ShellA payload wrote a PHP web shell to Strapi’s public uploads directory.T1552.001 · Credentials In FilesPayloads scanned hard-coded paths and system data for credentials, secrets, and cryptographic keys.T1552.007 · Container APIA reconnaissance payload sought Docker and Kubernetes secrets.T1611 · Escape to HostOne payload combined Redis exploitation with an attempt to escape a Docker container and write shell payloads to the host.

Threat Actors

UNC1069The article says a separate supply-chain attack targeting Axios was attributed to the North Korean threat cluster UNC1069.

Malware

WAVESHAPER.V2a platform-specific payload – a Python trojan for Linux and a PowerShell variant for Windows called WAVESHAPER.V2 – from a GitHub Gist.

Products

DockerPayloads evolved from Redis RCE and Docker escape to reconnaissance, credential harvesting, PostgreSQL exploitation, and persistent implants.npmResearchers discovered 36 malicious npm packages masquerading as Strapi v3 plugins that use postinstall scripts to exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and install persistentPostgreSQLnpm packages masquerading as Strapi v3 plugins that use postinstall scripts to exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and install persistent implants.Redis36 malicious npm packages masquerading as Strapi v3 plugins that use postinstall scripts to exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and install persistent implants.StrapiResearchers discovered 36 malicious npm packages masquerading as Strapi v3 plugins that use postinstall scripts to exploit Redis and PostgreSQL, deploy reverse shells, harvest credentials, and install persistent

Industries

Cryptocurrencypublished by four sock-puppet accounts and named to mimic legitimate Strapi plugins, likely target cryptocurrency-related assets and include attempts to exfiltrate Guardarian data; affected users should assume

Related Articles