GitHub Developer SSH Keys Targeted Through Malicious npm Packages

Security researchers recently discovered two new malicious packages on the npm open source package manager. These packages utilized GitHub to store stolen Base64-encrypted SSH keys taken from developer systems.

Identified earlier this month, the malicious packages have now been removed from npm. A recent report by ReversingLabs, published today, emphasizes an ongoing trend where cybercriminals exploit open source package managers for malicious software supply chain campaigns.

In a broader context, the company indicated a significant surge, with a 1300% increase in malicious packages identified on open source package managers from 2020 to the end of 2023. These malicious packages vary from low-threat protestware to more sophisticated campaigns that deliver malware directly from open source packages.

GitHub Developer SSH Keys Targeted Through Malicious Package

The initial package, known as warbeast2000, is currently in the development stage but displayed malicious behavior in its latest version. Upon installation, it initiated a post-install script that retrieved and executed a JavaScript file. This script accessed the private SSH key from the id_rsa file in the /.ssh directory, uploading the Base64-encoded key to a GitHub repository under the control of the attacker.

The second package, kodiak2k, followed a similar modus operandi, exhibiting additional functionalities across its versions. These functionalities included invoking the Mimikatz hacking tool and executing various scripts.

ReversingLabs issued a warning about the concerning nature of these attacks, highlighting the focus on SSH keys that could grant unauthorized access to GitHub repositories, potentially jeopardizing proprietary code.

Fortunately, the impact of this campaign was limited, with warbeast2000 downloaded approximately 400 times and kodiak2k around 950 times.

Despite the relatively contained impact, ReversingLabs expressed apprehension regarding the growing reliance of malicious actors on open source software and development infrastructure, particularly platforms like GitHub, for hosting components of malicious command-and-control (C2) infrastructure.

The advisory states, “As open source malware becomes more prevalent, malicious actors are increasingly utilizing GitHub to bolster their campaigns. These malware packages often provide extensive features and detailed documentation, enabling even low-skilled hackers (‘script kiddies’) to deploy them.”

“As malicious actors evolve their techniques in crafting malware, developers and security researchers must remain vigilant for emerging threats within public repositories.”

To mitigate these threats, the company advised developers to perform a security assessment before integrating software or a library from package managers such as npm or PyPI.

IOCS

Second stage payloads:

‍Follow Us on: Twitter, Instagram, Facebook to get the latest security news!