Cybersecurity researchers have discovered a number of suspicious packages published in the npm registry that are designed to harvest Ethereum private keys and gain remote machine access via the Secure Shell (SSH) protocol.
The packages attempt to “gain SSH access to the victim’s machine by writing the attacker’s SSH public key to the root user’s authorized_keys file,” software security company Phylum said. said in an analysis published last week.
List of packages whose purpose is to pretend to be legitimate a packet of ethersdefined as part of the company, listed as follows –
Some of these packages, most of which were published by the accounts “crstianokavic” and “timyorks”, are believed to have been released for testing purposes, as most of them make minimal changes. The last and most comprehensive package on the list is ethers-mew.
This is not the first time that fake packages with similar functionality have been discovered in the npm registry. In August 2023 Phylum in detail a package called ethereum-cryptography, a typosquat of a popular cryptocurrency library that stole users’ private keys on a server in China, introducing a malicious dependency.
The latest attack campaign takes a slightly different approach by embedding malicious code directly into packets, allowing threat actors to transfer Ethereum private keys to an “ether-sign(.)com” domain they control.
What makes this attack much more insidious is the fact that it requires the developer to actually use the package in their code – for example, creating a new instance of Wallet using the imported package – as opposed to the commonly observed cases of simply installing the package to run execution of malicious programs.
Additionally, the ethers-mew package has the ability to modify the “/root/.ssh/authorized_keys” file to add an SSH key belonging to the attacker and grant them permanent remote access to the compromised host.
“All of these packages, along with the authors’ accounts, were only active for a very short period of time, apparently removed and deleted by the authors themselves,” Fillum said.
