Skip to content

Back to the catalog

The OpenSourceMalware Show #16
opensourcemalware.comtalk

The OpenSourceMalware Show #16

Recap episode of The OpenSourceMalware Show covering three incidents: a Shai-Hulud-derived npm worm that compromised maintainer Jared Wray's account and spread to 400+ packages (including Keyv and cacheable, with ServiceTitan losing 100 packages) while harvesting credentials from GitHub, npm, AWS, Kubernetes, Vault, Azure, GCP, Terraform, Docker, and Slack; a "WEL1DROPPER" campaign flooding npm with 1000+ AI-slopsquatted malicious packages that execute on import rather than via install scripts; and "NullReceiver," a DPRK-linked C2 technique that hides C2 IPs inside the recipient address of empty Ethereum transactions, an evolution of EtherHiding found in at least 10 malicious packages.

TL;DR Podcast breakdown of a 400+ package npm worm, a 1000+ package AI-slopsquatting campaign, and a new DPRK EtherHiding-style C2 technique using blank Ethereum transactions.
Open original ↗

Organisations named here

  • EtherHiding
  • Jared Wray
  • NullReceiver
  • ServiceTitan
  • Shai-Hulud

Technologies named here

  • keyv
  • GitHub pre-publication malware scanning
  • cacheable
  • Microsoft scanning inside npm
  • OSV
  • ServiceTitan npm packages
  • npm ecosystem
  • Google Threat Intelligence
  • npm
  • GitHub
  • Ethereum
  • AWS
  • Kubernetes
  • Vault

Techniques named here

  • Postinstall script execution
  • Credential harvesting and exfiltration
  • GitHub dead-drop exfiltration
  • Slopsquatting
  • Execution on package import
  • DNS TXT record staging
  • Geofencing/CIS checks
  • EtherHiding
  • NullReceiver

Threat actors named here

  • Mini Shai-Hulud
  • Shai-Hulud
  • npm worm
  • WEL1DROPPER
  • Moika
  • NullReceiver
  • EtherHiding
  • Lazarus Group / DPRK
  • InvisibleFerret
  • Contagious Interview
  • DPRK

Related in Supply Chain