Cybersecurity researchers recently uncovered a series of malicious packages within the npm registry designed to compromise developers’ Ethereum wallets and remotely access their machines via SSH backdoor techniques. These suspicious packages, identified as derivatives of the reputable ethers package, specifically aim to harvest Ethereum private keys and facilitate unauthorized SSH access. These packages include ethers-mew, ethers-web3, ethers-6, ethers-eth, ethers-aaa, ethers-audit, and ethers-test. The highest count of downloads is attributed to ethers-aaa with 781 downloads.
Attack Vectors and Mechanisms
Malicious Code Embedding and Private Key Harvesting
The researchers from Phylum highlighted that the attack vectors involve embedding malicious code directly within these packages. This code captures Ethereum private keys and redirects them to a domain controlled by the attackers. A sophisticated aspect of this campaign is the requirement that developers actively use the package in their projects, such as by creating a new Wallet instance, which diverges from more common attacks where only the package installation is needed to trigger malicious activities. This specific targeting mechanism signifies a sophisticated level of planning by the attackers, ensuring that the payload is deployed only when the package is genuinely integrated into projects.
One particular package, ethers-mew, goes a step further by attempting to modify the "/root/.ssh/authorized_keys" file to include the attacker’s SSH key, thereby enabling persistent remote access to the infected machine. This method is particularly nefarious as it can grant attackers continuous control over compromised systems. Such access not only leaves developers vulnerable to financial loss through the theft of Ethereum private keys but also opens the door to a wide range of other potential attacks. These could include the exfiltration of additional sensitive data, the deployment of further malware, or leveraging the compromised machine for other nefarious activities.
Rapid Deployment and Removal Techniques
A notable point emphasized in the report is the rapid and likely deliberate short-lived nature of these packages and their associated accounts. Published by users "cristianokavic" and "timyorks," these packages appeared to serve a testing phase before potentially broader deployment. Their quick removal and self-deletion by the authors signify a level of sophistication and caution in avoiding detection and prolonging the utility of their malicious efforts. The transient nature of these malicious packages makes it challenging for security teams to detect and respond in a timely manner, often allowing the attackers to achieve their objectives before any countermeasures can be effectively implemented.
Historically, the npm registry has been a target for similar attacks. For example, in August 2023, a package called ethereum-cryptographyy was identified as a typosquat of a popular cryptocurrency library. This package exfiltrated private keys to a server based in China via a malicious dependency. The current incident differentiates itself by incorporating the attack payloads directly into the packages themselves. This evolved technique highlights an ongoing threat to software supply chains, where even trusted repositories and packages can become vectors for significant security breaches.
The Wider Implications for Software Supply Chain Security
Expanding Attack Surface and Evolving Tactics
Recently, cybersecurity experts discovered a range of harmful packages in the npm registry, targeting developers’ Ethereum wallets and utilizing SSH backdoor methods for remote access. These packages are disguised as variations of the well-known ethers package and are crafted to steal Ethereum private keys and enable unauthorized SSH access. The list of these malicious packages includes ethers-mew, ethers-web3, ethers-6, ethers-eth, ethers-aaa, ethers-audit, and ethers-test. Among these, ethers-aaa has seen the highest number of downloads, totaling 781.
These findings underscore the importance of vigilance when dealing with npm packages, as attackers are exploiting the platform to infiltrate systems and compromise sensitive information. Developers must routinely verify the integrity of the packages they use, paying close attention to the source and reviews to avoid potential threats. As hackers increasingly target blockchain technologies and cryptocurrency, staying informed about such security risks is crucial for protecting your assets and maintaining system integrity.