cyber.hendryadrian.com
Security News · opensourcemalware.com

GitHub Revokes npm 2FA-Bypass Token Privileges as DPRK’s NullReceiver Activity Grows

· Original article ↗

Summary

The episode covers GitHub revoking npm token privileges that bypass 2FA, growing DPRK-linked use of NullReceiver to conceal malware infrastructure, and security challenges involving AI skills and software supply chains.

Key points

  • GitHub announced it is closing a gap that allowed npm granular tokens configured to bypass 2FA to perform sensitive account, organization, and package-management actions.
  • The hosts report that the number of packages using the DPRK-linked NullReceiver technique has grown beyond seven confirmed examples.
  • NullReceiver obscures where malware retrieves its next stage and is appearing in varied, sometimes multi-stage chains, including alongside EtherHiding.
  • The hosts say malicious AI skills are difficult to assess because they use natural language and lack software supply-chain controls such as reliable provenance and release hashes.
  • Conference discussions highlighted gaps between AppSec teams’ supply-chain knowledge and SecOps teams’ malware and incident-response expertise.
  • The hosts say DPRK-linked actors use cryptocurrency payments for infrastructure and suggest that broader crypto payment options may offer defenders tracking opportunities.

Article Details

Event Type
Software supply-chain security developments: reported expansion of DPRK-attributed NullReceiver activity and GitHub’s revocation of npm granular access-token privileges that bypass 2FA.
Impact
The hosts report that NullReceiver use has grown beyond the seven previously confirmed packages and is being used to obscure where malware’s next stage comes from, sometimes in multi-stage chains involving EtherHiding. They also report that the technique has been observed alongside PolinRider-style activity involving malicious code pushed to compromised assets. GitHub’s change closes a gap that allowed npm tokens configured to bypass 2FA to perform sensitive account, organization, and package-management actions, reducing an account-takeover risk. The hosts say DPRK’s use of crypto payments for infrastructure may create tracking opportunities; specific infrastructure details were not disclosed.

People

Paul McCartyShared Open Source Malware’s observations that NullReceiver activity had increased and discussed related infrastructure and crypto-payment tracking opportunities.

Threat Actors

PolinRiderDescribed by Paul McCarty as a threat actor and campaign style associated with malicious code pushed to compromised assets; the source says its activity overlaps with NullReceiver use.

Vendors

GitHubGitHub revokes npm bypass-2FA token privileges. GitHub announced it is closing a gap that let npm granular access tokens configured to bypass two factor authentication perform sensitive account, org, and package

Products

npmGitHub revokes npm bypass-2FA token privileges. GitHub announced it is closing a gap that let npm granular access tokens configured to bypass two factor authentication perform sensitive account, org, and package

Countries

North Korea[00:00:40] Jenn Gile: We’re going to talk about some new activity that you’re observing with, um, North Korea in particular, like kind of a follow on to the NullReceiver stuff we were talking about last week. And hotUnited Kingdomkind of, uh, uh, kind of stalled on this one IP. Now, here’s the thing is that this IP is hosted in the UK. It has an RDP server. Uh, you can, like, you can go to, go to Shodan and you can see it.

Related Articles