Cybersecurity researchers have discovered three sets of malicious packages in the npm and Python Package Index (PyPI) repositories that have the ability to steal data and even delete sensitive data from infected systems.
The list of identified packages is given below –
- @async-mutex/mutex, typographic variant of async-mute (npm)
- dexscreener, which pretends to be a library for accessing liquidity pool data from decentralized exchanges (DEX) and interacting with the DEX Screener platform (npm)
- solana-transaction-toolkit (npm)
- solana-stable-web-hooks (npm)
- cschokidar-next, typoscotic by chokidar (npm)
- achokidar-next, typosquat by chokidar (npm)
- achalk-next, typosquat chalk (npm)
- csbchalk-next, typosquat melu (npm)
- cschalk, typosquat from chalk (npm)
- pycord-self, typosquat by discord.py-self (PyPI)
Socket supply chain security company that revealed packets, said the first four packets are designed to intercept Solana’s private keys and transmit them over Gmail’s simple mail transfer protocol (SMTP) servers with the probable purpose of draining victims’ wallets.
Specifically, the solana-transaction-toolkit and solana-stable-web-hooks programmatically drain a wallet by automatically transferring up to 98% of its contents to an attacker-controlled Solana address while claiming to offer Solana-specific functionality.
“Because Gmail is a trusted email service, these hijacking attempts are less likely to be flagged by firewalls or endpoint detection systems that treat smtp.gmail.com as legitimate traffic,” said security researcher Kirill Boychanka.
Socket reported that it also came across two GitHub repositories published by the threat actors behind solana-transaction-toolkit and solana-stable-web-hooks that purported to contain Solana development tools or scripts to automate common DeFi workflows, but actually import the malicious npm packages of the threat actor.
The GitHub accounts associated with these repositories, “moonshot-wif-hwan” and “Diveinprogramming”, are no longer available.
“A script in the threat actor’s GitHub repository, moonshot-wif-hwan/pumpfun-bump-script-bot, promotes itself as a trading bot on Raydium, a popular Solana-based DEX, but instead it imports malicious code from the solana- stable-web package -huks,” Boychanka said.
The use of malicious GitHub repositories illustrates the attackers’ attempts to mount a broader campaign outside of npm, targeting developers who may be looking for Solana-related tools on the Microsoft-owned code hosting platform.
The second set of npm packages was found to take their malicious functionality to the next level by including a “kill switch” feature that recursively erases all files in project-specific directories, in addition to exfiltrating environment variables to a remote server in some cases.
The fake csbchalk-next package functions identically to the typosquatted versions of chokidar, except that it initiates the delete operation only after receiving a “202” code from the server.
Pycord-self, on the other hand, highlights Python developers seek to integrate the Discord API into their projects by capturing Discord authentication tokens and connecting to an attacker-controlled server for persistent backdoor access after installation on Windows and Linux systems.
Development happens like bad actors targeting Roblox users with cheat libraries created to facilitate data theft with open source malware such as Skuld and Blank-Grabber. Imperva last year revealed that Roblox players looking for cheats and mods have also been targeted by fake PyPI packages that trick them into downloading the same payloads.
