Infected jQuery Packages Detected on npm, GitHub, and jsDelivr Code Repositories
Hackers have been discovered spreading infected versions of jQuery on npm, GitHub, and jsDelivr in what seems to be a case of a sophisticated and persistent supply chain breach.
“This assault is remarkable due to the extensive variability seen in the packages,” Phylum stated in an analysis released last week.
“The hacker has skillfully concealed the malware in the rarely-used ‘end‘ function of jQuery, which is internally invoked by the more popular ‘fadeTo‘ function from its animation utilities.”
A total of 68 packages have been associated with the campaign. These were uploaded to the npm registry from May 26 to June 23, 2024, under names such as cdnjquery, footersicons, jquertyi, jqueryxxx, logoo, and sytlesheets, among others.
There are indications that all of the fake packages were manually created and uploaded considering the number of packages uploaded from different accounts, varied naming conventions, inclusion of personal files, and the extended duration over which they were added.
This differs from common practices where attackers typically adhere to a set pattern, indicating some level of automation in crafting and releasing the packages.
According to Phylum, the malicious modifications have been made in a function called “end,” enabling the threat actor to siphon off website form data to a remote URL.
Further investigation has disclosed that the infected jQuery file is hosted on a GitHub repository linked to an account named “indexsc.” The same repository also contains JavaScript files with a script pointing to the altered version of the library.
“It’s important to note that jsDelivr automatically generates these GitHub URLs without requiring explicit uploading to the CDN,” Phylum added.
“This could be an effort by the attacker to make the source appear more authentic or bypass firewalls by utilizing jsDelivr instead of directly loading the code from GitHub.”
The development comes as Datadog discovered a sequence of packages on the Python Package Index (PyPI) repository with capabilities to fetch a second-stage binary from a server controlled by the attacker based on the CPU architecture.
About Author
