cyber.hendryadrian.com
Threat Research · opensourcemalware.com

Researchers Detail npm Worm, WEL1DROPPER Campaign and DPRK-Linked NullReceiver C2 Technique

· Original article ↗

Summary

The episode analyzes an npm worm that compromised 400+ packages and stole credentials, a campaign publishing over 1,000 malicious npm packages, and a DPRK-linked technique that hides C2 IPs in empty Ethereum transfers.

Key points

  • A compromised maintainer account was used to publish a Mini Shai-Hulud-based worm across more than 400 npm packages; ServiceTitan reportedly had 100 packages affected.
  • The worm searched developer machines and CI runners for credentials spanning GitHub, npm, cloud platforms, Kubernetes, Vault, Terraform, Docker and Slack, then exfiltrated them.
  • Researchers found the worm within minutes of publication, raising questions about the effectiveness and rollout of GitHub's announced pre-publication malware scanning.
  • WEL1DROPPER published over 1,000 malicious npm packages in 72 hours. Its payload executes on package import rather than through install scripts; attribution to Russian actors remains uncertain.
  • NullReceiver hides a C2 IP address or short URL in the recipient field of an empty Ethereum transaction, avoiding reliance on a fixed, publicly known destination address.
  • At least 10 packages were observed using NullReceiver, which researchers link to DPRK activity and describe as a stage preceding EtherHiding in some attack chains.

Article Details

Attack Vectors
  • Threat actors used Jared Wray’s compromised GitHub account to publish an npm worm that spread through more than 400 packages.
  • The worm searched developer machines and CI runners for credentials and exfiltrated credentials it found.
  • WEL1DROPPER packages execute when imported rather than relying on npm lifecycle install scripts; the packages were described as malicious forks or typosquats.
  • NullReceiver hides a C2 IP address or short URL in the recipient address of an empty Ethereum transaction. The article says this can precede EtherHiding, which carries additional information in blockchain transaction data.
  • A backup stage-two retrieval method for WEL1DROPPER pulls content from DNS TXT records associated with a .ru domain.
Defensive Notes
  • Disabling npm lifecycle scripts alone does not prevent WEL1DROPPER packages from executing when imported.
  • Monitoring the fixed public burn address used by EtherHiding can help detect that technique, but NullReceiver avoids reliance on a fixed, publicly known destination address.
  • The speakers said researchers found the npm worm within minutes of publication, raising concerns that pre-publication malware scanning did not catch it.

MITRE ATT&CK

T1059.007 · JavaScriptThe npm worm contains an obfuscated JavaScript payload; WEL1DROPPER packages execute their payload when imported.T1071.004 · DNSA backup WEL1DROPPER stage-two retrieval method pulls content from DNS TXT records associated with a .ru domain.T1195.002 · Compromise Software Supply ChainThreat actors used a compromised maintainer GitHub account to publish a worm through npm packages.

People

Jared WrayMaintainer whose compromised account was used to publish the npm worm.Jenn GileDiscussed the reported npm threats and NullReceiver technique.Paul McCartyDiscussed the threat research, including the WEL1DROPPER campaign and NullReceiver technique.

Threat Actors

Lazarus GroupThe speakers said NullReceiver appeared to be used by Lazarus Group, while qualifying the attribution as uncertain.

Malware

ChainDropwas compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400 packages, with ServiceTitan alone losing 100 packages, and itWEL1DROPPERWEL1DROPPER floods npm with AI slopsquatted packages: Over the past 72 hours, more than a thousand malicious packages have been published to npm as part of a campaign we're calling WEL1DROPPER.

Vendors

GitHubNew npm worm hits Keyv and cacheable: Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400

Products

npmNew npm worm hits Keyv and cacheable: Jared Wray's GitHub account was compromised on Tuesday, and threat actors used it to publish a worm based on the open-sourced Mini Shai-Hulud malware. The worm spread to over 400

Countries

North Koreasame threat actor. We don't see as much, uh, Russian, uh, malicious open source as we do things out of North Korea, obviously.Russialike, if you're a Russian threat actor, why would you do that? 'Cause you know that's a death sentence in Russia. But here's the other thing, is it also has, like one of them I was looking at had the CIS checks, right?

Related Articles