Attackers have been observed uploading over 15,000 spam packages to the npm open source JavaScript repository from multiple user accounts within hours.
This claim was posted by Javascript developer Jesse Mitchell. on Twitter on tuesday.
“I’ve noticed a spam attack on npm, with tens of thousands of packages flooding the registry and occupying the front page,” writes Mitchell.
We then analyzed the findings further. check marx Cybersecurity expert Yehuda Gelb discussed it in an advisory published on Tuesday.
“Further investigation uncovered a recurring attack vector in which cyber attackers used spam techniques to flood the open source ecosystem with packages containing links to phishing campaigns in their readme.md files.” Gelb explained.
The security researcher said the malicious packages were created using an automated process that auto-generated project descriptions and names similar to each other.
“The package appeared to contain the exact same automation code used to generate these packages, possibly accidentally uploaded by the attacker,” said Checkmarx. Recommendation.
“The generated script also contains valid credentials used by the attacker in the attack flow.”
According to Gelb, the attackers behind this campaign used referral IDs to browse retail websites in order to profit from earned referral rewards.
“While investigating phishing websites, we noticed that some of them redirected to e-commerce websites using referral IDs,” writes a security researcher.
“This highlights the potential for financial gain for attackers involved in such phishing campaigns.”
Gelb also said the attackers behind this malicious campaign appear to be similar to previous spam attacks Checkmarx detected in December 2022.
“The battle against attackers polluting the software supply chain ecosystem continues to be challenging. Attackers are constantly adapting and surprising the industry with unexpected new techniques,” said Gelb. I’m here.
“By working together, we can stay one step ahead of attackers and keep our ecosystem safe.”
Checkmarx advisory will be published weeks after ReversingLabs Found malicious package On npm using the typosquatting technique.
