Christmas-Themed npm Campaign Uses Packages to Exfiltrate Files from /opt
Summary
A reported npm campaign includes 36 Christmas-themed packages across 23 users. Older packages send /opt/index.js to a collection endpoint; newer ones use a preinstall script to send files from /opt to a webhook.
Key points
- The article reports 36 campaign packages across 23 npm users and says the package count is growing.
- Package metadata claims a new package is generated automatically every two minutes.
- An earlier payload sends a base64-encoded copy of /opt/index.js to 554663322[.]free[.]beeceptor[.]com.
- A newer preinstall script collects files under /opt and sends their contents to a webhook[.]site endpoint.
- The author says the packages are unlikely to compromise users because of their conspicuous names, but notes the potential for file exfiltration if installed.
Article Details
- Event Type
- Malicious NPM package campaign using post-install scripts to exfiltrate files
- Impact
- The packages can send the contents of files in the /opt directory to external endpoints. An earlier payload specifically sent a base64-encoded copy of /opt/index.js. The article says the campaign contained 36 packages across 23 NPM users at the time of reporting and was growing.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| URL | hxxps[:]//554663322[.]free[.]beeceptor[.]com | Endpoint used by an earlier package payload to receive a POST containing a base64-encoded copy of /opt/index.js. |
| URL | hxxps[:]//webhook[.]site/3c6dc51c-8e52-474b-8444-9943645174f6 | Specific webhook URL used by a post-install payload to exfiltrate files from the /opt directory. |