Widespread npm Compromise Uncovered
A significant supply chain attack has been detected within the npm ecosystem, targeting popular packages such as keyv and cacheable. At least ten npm packages were compromised and published with a malicious preinstall script, specifically a file named setup.mjs. This script serves as an initial entry point for attackers, initiating a multi-stage payload designed to exfiltrate sensitive information and potentially further compromise the npm registry.
The affected packages collectively boast tens of millions of weekly downloads, indicating a broad potential impact across the developer community. The attackers leveraged a compromised maintainer account, identified as Jaredwray, to inject the malicious code. The compromise initially affected packages within the keyv and cacheable families. Subsequently, the attackers utilized stolen npm credentials to publish additional malicious packages, extending their reach beyond these initial namespaces and suggesting a sophisticated, escalating operation.
Malicious Payload Analysis
The setup.mjs script is designed to operate covertly and effectively. Upon execution during the npm package installation process, it first downloads and executes a standalone Bun runtime. This runtime is used to execute a second-stage payload, which is intentionally obfuscated to evade detection by security software and analysis tools. The primary objective of this payload is to collect cloud and CI/CD credentials that may be present on the compromised development or build environment.
Beyond credential theft, the attackers demonstrated the capability to publish trojanized versions of additional npm packages. This is achieved by utilizing stolen npm tokens, which grant them the ability to push new code to existing packages or even create new malicious ones under legitimate namespaces. This capability poses a severe threat, as it allows attackers to spread further compromised software, potentially affecting a much larger user base and creating a cascading effect of infections. The ongoing nature of the threat is underscored by the possibility that additional malicious packages may continue to surface as the attackers exploit their access.
Technical Details of the Attack Chain
The attack chain begins with the installation of a compromised npm package. During the npm install process, the malicious preinstall hook, setup.mjs, is automatically executed. This script acts as a loader for the more complex malicious operations.
The first action taken by setup.mjs is to fetch and execute a Bun runtime. Bun is a modern, fast JavaScript runtime, bundler, transpiler, and package manager. Using Bun allows the attackers to execute their payloads in an environment that might be less scrutinized than Node.js, and it provides them with a versatile toolset for their subsequent actions. The Bun runtime then proceeds to execute an obfuscated script. The obfuscation is a critical defense-evasion technique, making it difficult for security analysts to understand the script's true intent and functionality without significant effort.
The core function of the obfuscated payload is to identify and exfiltrate sensitive credentials. This includes credentials for cloud service providers (e.g., AWS, Google Cloud, Azure) and continuous integration/continuous deployment (CI/CD) systems (e.g., GitHub Actions, GitLab CI). These credentials are prime targets for attackers, as they grant access to infrastructure, code repositories, and deployment pipelines, enabling further malicious activities, including the propagation of more malware.
A particularly alarming capability is the ability to publish trojanized npm packages. If the attackers obtain a valid npm authentication token from the compromised environment, they can use it to publish malicious versions of other npm packages. This could involve injecting backdoors, adding further malicious scripts, or altering the functionality of legitimate software. This mechanism allows attackers to scale their operations and infect a wider range of projects that depend on these packages.
Scope and Mitigation
The scope of this attack is considerable, given the high download counts of the affected packages. Developers relying on keyv, cacheable, and other packages published by the compromised Jaredwray account are at risk. The attack highlights the inherent vulnerabilities in software supply chains, where a single compromised account or dependency can have far-reaching consequences.
Immediate mitigation steps are crucial for any developer or organization using these packages. Users should:
- Review their installed npm packages and identify any that are part of the
keyvorcacheablefamilies, or published byJaredwray. - Audit their CI/CD pipelines and development environments for any signs of suspicious activity or unauthorized credential usage.
- Revoke and rotate any cloud or CI/CD credentials that may have been exposed.
- Consider using package integrity verification tools and lock files (e.g.,
package-lock.json) to ensure that only known-good versions of dependencies are installed. - Stay informed about npm security advisories and monitor the official npm status page for updates regarding compromised packages.
The npm security team is actively investigating the incident and working to remove the malicious packages from the registry. However, the nature of supply chain attacks means that vigilance and proactive security measures are essential. The potential for additional malicious packages to emerge necessitates ongoing monitoring and a robust security posture.