OpenSourceMalware Show #18 Covers Rust, RubyGems and npm Supply-Chain Attacks
Summary
The episode discusses a compromised Rust maintainer account, related RubyGems and npm typosquatting campaigns, increased use of binary payloads, and PolinRider reinfections involving NullReceiver.
Key points
- A compromised maintainer account published malicious Rust crate versions that pulled in a typosquatted dependency executing a remote binary during compilation; Wiz linked campaign infrastructure to a DPRK actor.
- A RubyGems typosquatting campaign and a 40-package npm cluster delivered byte-identical payloads: a Rust loader and embedded Go infostealer. Similar activity in PowerShell was reported but not yet verified by the speakers.
- The RubyGems payload targeted Windows, using package installation hooks to launch the loader and exfiltrate data; it also reportedly bypassed Chrome App-Bound Encryption.
- Researchers reported a recent increase in supply-chain malware packages using compiled C++, Rust, and Go binaries, which can themselves be conspicuous indicators.
- PolinRider reinfections continue because malware can remain on developers’ machines and alter local Git history before changes are pushed; the latest iteration uses NullReceiver instead of EtherHiding for stage-two hiding.
Article Details
- Event Type
- Podcast discussion of software supply-chain compromises involving malicious Rust, RubyGems, and npm packages, alongside PolinRider reinfections and increased use of compiled binary payloads.
- Impact
- Malicious package dependencies and install or compile-time execution delivered loaders and infostealers. Reported effects include theft of credentials, cryptocurrency, and browser data, data exfiltration, and reinfection of developers through compromised machines and repository history.
People
Malware
Products
GitHuband the fact that the, the point I was just gonna make is that it pulls that, that 22 meg file from a GitHub repo.Google Chromethat this attack was sending us, it actually had a pretty well done, um, a bypass around the, the Google Chrome App-Bound Encryption, um- Yes ... control.npma shared C2 endpoint pattern and overlapping IP ranges, to the same DPRK actor behind the Mastra and Axios npm compromises.PowerShellany organization running both a Ruby and a Node stack. There's also evidence that this campaign hit the PowerShell ecosystem.RubyGemsStubMaker spreads from RubyGems to npm: What started as a RubyGems typosquatting campaign targeting bundler, i18n, rake, and activesupport turned out to share byte-for-byte identical payloads with a separate 40 package