Roblox Game Developers Facing Threat from Over a Dozen Malicious npm Packages

Since the beginning of August 2023, over twelve malicious packages have been found in the npm package repository. These packages have the ability to install an open-source information stealer named Luna Token Grabber on systems owned by Roblox developers.

Malicious npm Packages

Since August 1, an ongoing effort was discovered by ReversingLabs. This effort uses modules that pretend to be the real package noblox.js. This package is a tool that helps make scripts for the Roblox gaming platform.

The company that focuses on securing software supply chains compared this to a similar attack from two years ago, in October 2021.

In an analysis on Tuesday, software threat researcher Lucija Valentić explained that the harmful packages “…copy code from the real noblox.js package but also include dangerous functions meant to steal information.”

The packages were downloaded a total of 963 times before they were removed. The packages that caused the issue had these names:

• noblox.js-vps (versions 4.14.0 to 4.23.0)
• noblox.js-ssh (versions 4.2.3 to 4.2.5)
• noblox.js-secure (versions 4.1.0, 4.2.0 to 4.2.3)

Although the general pattern of this recent attack resembles the previous one, it also shows some unique traits. One key difference is in the use of an executable that carries Luna Grabber.

This occurrence is an unusual case of a multi-stage infection process found on npm, as stated by ReversingLabs.

“Regarding harmful campaigns that focus on software sources, the distinction between complex and simple attacks usually centers on how much the malicious individuals try to hide their attack and make their harmful packages seem valid,” highlighted Valentić.

The modules, in particular, skillfully hide their harmful functions in a distinct file named postinstall.js, which activates after the installation is completed. This is because the legitimate noblox.js package uses a file with the same name to show appreciation to its users, along with links to its documentation and GitHub repository.

ReversingLabs reported that the second stage evolved with each update, adding more features and obfuscation to prevent analysis. The main task of this script is to download Luna Token Grabber, a Python tool capable of collecting credentials from web browsers and Discord tokens.

Surprisingly, the perpetrator of the npm campaign seems to have chosen to gather only system information from victims using a customizable builder provided by the authors of Luna Token Grabber.

Luna Token Grabber has been encountered before. In June, Trellix revealed a new information-stealing tool called Skuld, built in Go, which shares similarities with this malware strain.

Indicators of Compromise (IoCs) – npm packages

Second stage payloads: