Tor-Backed npm Worm Steals Developer Credentials and Reinfects Maintainer Packages
Summary
Researchers describe a typosquatted npm package that steals npm and GitHub credentials, republishes trojanized packages through compromised maintainer accounts, and deploys a Tor-connected implant on Linux systems.
Key points
- The crypto-javascri package masqueraded as crypto-js and used install and developer-tool hooks to run a Rust binary.
- The worm harvested npm and GitHub tokens, checked their validity, and enumerated packages and repositories belonging to the victim.
- Using stolen npm credentials, it injected itself into maintained packages and republished them with added execution hooks, enabling downstream propagation.
- The final implant was based on the Arti Tor client and included credential theft, cryptocurrency-related capabilities, and user-level systemd persistence.
- The malware checked for cloud-provider metadata and used a Tor hidden service for command and control.
- Researchers said the observed onion service was offline, but warned that this did not establish remediation; they recommended auditing package releases, revoking compromised tokens, and checking for suspicious hooks, Tor activity, and persistence.
- Attribution to Sukob and possible links to Team PCP were presented as unconfirmed hypotheses.
Article Details
- Attack Vectors
- The typosquatted npm package crypto-javascri used installation hooks to execute a Rust binary on developer systems.
- Claude Code SessionStart hooks and VS Code folderOpen tasks could execute the binary when a project workspace was opened.
- The binary read npm and GitHub credentials, then used victim maintainer accounts to inject itself into and republish packages.
- The implant used a Tor hidden service for command and control and deployed a Python dropper and privilege-escalation payload.
- A user-level systemd service provided persistence.
- Defensive Notes
- Monitor for suspicious npm preinstall hooks and unexpected execution from hidden project directories such as ./.claude/.
- Audit for unauthorized package publications and access to ~/.npmrc and ~/.git-credentials; revoke compromised tokens.
- Alert on unexpected Tor/Arti activity and user-level persistence involving ~/.local/bin/ and systemd user services.
MITRE ATT&CK
T1059.004 · Unix ShellThe stage 3 payload invoked /bin/sh to execute a command received from its parent stage.T1195.002 · Compromise Software Supply ChainThe attacker distributed a trojanized npm package that executed during installation and propagated through other maintained packages.T1543.002 · Systemd ServiceThe implant established persistence with a user-level systemd service configured to restart.T1548.001 · Setuid and SetgidThe stage 3 payload called setuid(0) and attempted to exploit the SUID bit on /usr/bin/su for privilege escalation.T1552.001 · Credentials In FilesThe binary read npm and GitHub credentials from ~/.npmrc and ~/.git-credentials.
Threat Actors
SukobThe campaign is linked to Sukob based on underground-source information; the article says the sample's technical evidence does not independently confirm the attribution.Team PCPThe article presents possible collaboration with operators associated with Team PCP as an intelligence-led hypothesis, not a technically proven attribution.
Vendors
Products
Artimaintainer accounts to silently republish trojanized packages. The final payload was a weaponized Arti Tor client with credential theft, persistence, and Tor based C2, enabling resilient and difficult toClaude Code2. Claude Code ##SessionStart## hookGitHubnpm supply chain attack involving the typosquatted package crypto-javascri, which harvested npm and GitHub credentials and used compromised maintainer accounts to silently republish trojanized packages. The finalnpmCloudSEK TRIAD identified a sophisticated npm supply chain attack involving the typosquatted package crypto-javascri, which harvested npm and GitHub credentials and used compromised maintainer accounts to silentlyVS Code3. VS Code ##folderOpen## task