Investigation Finds AccuraSoftHire Malicious npm Packages Stayed Available for Months
Summary
StepSecurity found AccuraSoftHire’s malicious npm packages remained available for up to 211 days and decoded 609 Ethereum-wallet transactions naming eight loader servers. JFrog found no link between AccuraSoftHire and the Binance intrusion.
Key points
- JFrog described three lures used by the fake company: a take-home coding task, a camera “driver,” and an unpacked browser extension. JFrog could not determine whether the extension path delivered malware.
- The PolinRider loader can run during a Tailwind CSS build rather than during npm install, so tools that only monitor install scripts may miss it.
- StepSecurity’s npm registry review found one look-alike package available for 211 days and another for 169 days. Download counts include mirrors and security scanners, so they may overstate real installs.
- StepSecurity decoded 609 transactions from the wallet used to publish loader server addresses, identifying eight server IPs. The last listed transaction was on October 19, 2026; the article reports no later transactions as of November 13.
- JFrog found no link between AccuraSoftHire and Binance’s reported intrusion; the article presents them as separate findings.
- The article recommends using isolated virtual machines for external interview assignments, disabling automatic VS Code tasks, searching developer machines for listed packages and files, and rotating credentials if infection is found.
Article Details
- Attack Vectors
- A fake employer recruited developers through job platforms and asked them to run a take-home assignment on a work computer; malicious code ran when Tailwind built the project CSS.
- Look-alike npm packages added a loader to legitimate-looking plugin code. The packages remained available for up to 211 days, and npm recorded thousands of downloads for some packages.
- A fake camera-driver download installed and ran a JavaScript payload in the background.
- Candidates were directed to load an unpacked browser extension and run a PowerShell script that registered a native messaging helper and scheduled recurring contact with the site; JFrog could not determine whether this path delivered malware.
- The loader retrieved its server address from Ethereum transactions, downloaded and decoded two stages over port 443, and ran them. PolinRider infections were also reported to steal credentials and spread the loader into other repositories.
- Defensive Notes
- Do not run external interview assignments, drivers, or setup commands on work machines. Use a separate virtual machine without credentials or browser profiles for interviews.
- Search developer machines for the listed npm packages, `.vscode/tasks.json` files configured with `runOn: folderOpen`, and the `job-new-alerts` extension folder.
- Disable automatic VS Code tasks, keep Workspace Trust enabled, and open unfamiliar projects in Restricted Mode.
- Search network logs for the eight listed server IPs and requests to `/0x/cls`, `/0x/ls`, or requests containing the `Sec-V` header.
- If a machine is suspected of infection, rotate all credentials on it and inspect repositories for loader additions; the article warns that wiping a laptop alone may not prevent reinfection.
- Use a package cooldown policy, while noting that it would not have blocked the two packages that remained on npm for months.
- Monitor or restrict unexpected outbound connections from CI builds, including requests to public Ethereum endpoints and plain HTTP connections to IP addresses on port 443.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | accurasofthire[.]com | Fake careers site identified by JFrog that also served payload-related resources. |
| IPV4 | 103[.]179[.]142[.]155 | Newest server address decoded from the attacker's Ethereum wallet; the analyzed camera payload contacted it. |
| IPV4 | 166[.]88[.]134[.]62 | Malware server address decoded from transactions sent by the attacker's Ethereum wallet. |
| IPV4 | 166[.]88[.]134[.]75 | Malware server address decoded from transactions sent by the attacker's Ethereum wallet. |
| IPV4 | 166[.]88[.]73[.]46 | Malware server address decoded from transactions sent by the attacker's Ethereum wallet. |
| IPV4 | 193[.]247[.]144[.]38 | Malware server address decoded from transactions sent by the attacker's Ethereum wallet. |
| IPV4 | 23[.]27[.]13[.]135 | Malware server address decoded from transactions sent by the attacker's Ethereum wallet. |
| IPV4 | 23[.]27[.]13[.]72 | Malware server address decoded from a transaction sent by the attacker's Ethereum wallet. |
| IPV4 | 91[.]218[.]183[.]174 | Malware server address decoded from transactions sent by the attacker's Ethereum wallet. |
MITRE ATT&CK
T1053.005 · Scheduled TaskThe browser-extension helper offered a scheduled task that contacted the site every five minutes.T1059.001 · PowerShellA PowerShell script registered the browser-extension helper and offered a scheduled task.T1059.007 · JavaScriptThe malicious package and camera-driver paths ran JavaScript payloads.T1071.001 · Web ProtocolsThe loader communicated with its server using HTTP on port 443, according to the article.T1105 · Ingress Tool TransferThe loader downloaded two additional stages from its server, and the driver path downloaded a JavaScript payload.T1140 · Deobfuscate/Decode Files or InformationThe loader decoded the two downloaded stages before running them.T1176 · Software ExtensionsCandidates were instructed to load an unpacked Chrome extension from the `job-new-alerts` folder.T1195.001 · Compromise Software Dependencies and Development ToolsLook-alike npm packages carried the loader, which ran when the project built its CSS.T1204.002 · Malicious FileCandidates were induced to run an interview assignment or download and run a purported camera driver.T1552.004 · Private KeysOpenSourceMalware reports that infected machines lose SSH keys.T1555.003 · Credentials from Web BrowsersOpenSourceMalware reports that infected machines lose browser credentials.T1565.001 · Stored Data ManipulationThe malware reportedly added the loader to other repositories and rewrote commits to retain their original dates.
Malware
Vendors
Products
Edgethem run a PowerShell script from the site. That script registers a small helper program that Chrome and Edge are allowed to start (a "native messaging host" named com.accurasoft.jobalerts), and offers a scheduledGoogle ChromeA third page tells candidates to load a Chrome extension by hand: turn on Developer mode, choose "Load unpacked", and pick a folder named job-new-alerts. It then has them run a PowerShell script from the site. ThatHarden-RunnerInfected project built in CI Harden-Runner Flags or blocks unexpected outbound connections from the buildMalicious Files for GitHubLoader added to your repositories Malicious Files for GitHub Scans every file version in git history and names the commit that added a flagged filenpmSome of the poisoned packages stayed on npm for months. Two packages the interview task used were installable for about five and seven months, until npm replaced them on November 12 and 13. npm recorded more than 4,000StepSecurity Dev Machine GuardLook-alike package installed on a laptop Dev Machine Guard: OSS Packages Finds the machines and project folders that have the packageStepSecurity Secure RegistryNewly published malicious package Secure Registry cooldown Blocks package versions published within a set number of daysTailwind CSSis asked to finish a React landing page in ninety minutes. In the version JFrog shows, the project's Tailwind CSS configuration loads eleven plugins. Ten are real. The eleventh, tailwind-custom-forms, is a copy ofVS Codeproject builds, when the candidate runs the "driver" command, or, in other PolinRider infections, when VS Code opens a folder with an auto-run task. Tools that only watch or disable npm install scripts do not see any
Countries
Australiaon September 18 by the FBI, the US Department of Defense Cyber Crime Center, and agencies in Japan, Australia and Germany says North Korean actors running fake-interview campaigns infected at least 30,000 devicesGermany18 by the FBI, the US Department of Defense Cyber Crime Center, and agencies in Japan, Australia and Germany says North Korean actors running fake-interview campaigns infected at least 30,000 devices in more thanJapanpublished on September 18 by the FBI, the US Department of Defense Cyber Crime Center, and agencies in Japan, Australia and Germany says North Korean actors running fake-interview campaigns infected at least 30,000North Koreareported as the largest cryptocurrency theft to date. Binance says the FBI attributes the attack to North Korea. One of the first steps was a fake job interview. A software engineer was approached on a job platform