Deceptive npm Packages Aim Developers’ Ethereum Wallets via SSH Backdoor

Oct 22, 2024Ravie LakshmananVulnerability / Supply Chain

A group of security analysts has unearthed several suspicious modules uploaded to the npm registry aimed at extracting Ethereum private keys and establishing remote control over the system using the secure shell (SSH) mechanism.

These modules endeavor to “access the victim’s system through SSH by inserting the hacker’s SSH public key into the root user’s authorized_keys file,” software integrity firm Phylum disclosed in a report released last week.

The enumeration of the deceitful modules intending to counterfeit the genuine ethers package as part of the operation are as follows –

A subset of these modules, with most being uploaded by profiles named “crstianokavic” and “timyorks,” are assumed to have been made available for experimental purposes, characterized by insignificant variances. The most current and comprehensive addition in the inventory is ethers-mew.

This sequence of events isn’t the maiden occurrence of packages with similar functionality being detected in the npm registry. In August 2023, Phylum detailed an instance where a package under the name ethereum-cryptographyy, masquerading as a renowned digital currency library, was transmitting users’ private keys to a server located in China via an intrusive dependency.

The latest offensive strategy involves a slightly altered tactic where the malevolent code is infused directly into the modules, enabling malevolent actors to divert the Ethereum private keys to their domain “ether-sign[.]com” that is subject to their command.

Distinctively sly, this offensive maneuver demands the developer to actively incorporate the module into their code – like initiating a new Wallet instance via the imported module – in contrast to conventional scenarios where just installing the module would prompt the malware’s execution.

Moreover, the ethers-mew module encompasses functionalities to alter the “/root/.ssh/authorized_keys” file to introduce an SSH key owned by the attacker and allow them continuous remote access to the compromised host.

“All these modules, in conjunction with the creators’ accounts, were available only for a brief span of time, apparently withdrawn and eradicated by the authors themselves,” Phylum confirmed.