AsyncAPI npm Supply Chain Attack: Malware Injected Into Popular Packages
Sophisticated malware discovered in packages with 2 million weekly downloads.
1Widespread Security Breach
OX Security researchers revealed that four popular packages under the AsyncAPI npm organization were compromised with malicious code. These packages, with over 2 million weekly downloads, are widely used by developers building event-driven APIs. The attack's impact spans a significant portion of professional development environments.
2Sophisticated Multi-Stage Attack
Researchers describe this as a highly complex, multi-stage supply chain attack. The malware combines information-stealing, cryptocurrency theft, and Remote Access Trojan (RAT) capabilities. With 91,973 lines of code, the malicious software mimics known campaigns to mislead analysts.
3Resilient Infrastructure and Communication
Attackers utilize legitimate peer-to-peer networks like IPFS (InterPlanetary File System) for communication. IPFS serves as a fallback when primary command-and-control servers fail. BitTorrent bootstrap nodes provide additional communication channels, creating multiple redundancy paths to bypass network blocks.
4Self-Propagation Capability
The malware can self-replicate by injecting itself into packages maintained by compromised developer accounts on npm, PyPI, or Cargo registries. This feature transforms a single breached account into a new distribution vector, significantly increasing the attack's spread potential.
5Evasion Techniques
The malware checks for virtual machine environments, endpoint detection tools, and Russian system locales - terminating if any are detected. This standard technique prevents infection of attackers' own machines or execution in security researchers' sandboxes.
6Critical Developer Actions
Developers using affected package versions must immediately revoke npm, PyPI, and Cargo tokens, rotate secrets, and audit registry changes. Monitoring for unexpected connections to BitTorrent nodes or IPFS gateways is crucial. npm v12's post-install script blocking proved ineffective as code was directly injected into main files.
Original article: Security Affairs — AsyncAPI npm Paketlerine Yapılan Zararlı Yazılım Enjeksiyonu