Deceptive npm Packages Target Programmers’ Ethereum Purses with SSH Trapdoor
Computer security analysts have come across several doubtful packages shared on the npm registry that are crafted to collect Ethereum secret keys and acquire distant entry to the machine via the secure shell (SSH) protocol.
The packages endeavor to “capture SSH entry to the victim’s machine by inscribing the invader’s SSH public key in the root user’s authorized_keys file,” software source chain security company Phylum stated in an analysis put out last week.
The lineup of packages, which strive to mimic the bona fide ethers package, recognized as part of the strategy are cataloged as follows –
A few of these packages, most of which have been released by profiles titled “crstianokavic” and “timyorks,” are believed to have been put out for trial reasons, as most of them present slight variations across them. The newest and most exhaustive package in the catalog is ethers-mew.
This is not the initial occurrence rogue packages with comparable functionality have been detected in the npm registry. In August 2023, Phylum outlined a package named ethereum-cryptographyy, a typosquat of a well-known cryptocurrency library that siphoned off the users’ secret keys to a server in China by inserting a malevolent dependency.
The most recent attack campaign adopts a slightly distinct method in which the malevolent code is embedded directly into the packages, allowing malicious actors to drain the Ethereum secret keys to the domain “ether-sign[.]com” under their control.
What renders this assault much more underhanded is the necessity for the developer to genuinely utilize the package in their code – like creating a new Wallet instance using the imported package – unlike commonly observed scenarios where just installing the package is adequate to initiate the execution of the malware.
Moreover, the ethers-mew package is furnished with functionalities to alter the “/root/.ssh/authorized_keys” file to append an invader-owned SSH key and grant them enduring remote access to the infringed host.
“All of these packages, along with the authors’ accounts, were only up for a very brief period of time, seemingly removed and eradicated by the authors themselves,” Phylum said.
About Author
