The packages were discovered by Sonatype researchers over the Thanksgiving weekend.
“This time, the typosquatting packages identified by us are laced with a popular Remote Access Trojan (RAT).” states the post published by Sonatype.
“The malicious packages are:
Both packages were created by the same author last week who masqueraded them as tools to work with JSON files.
The two were downloaded more than 100 times before they were discovered by Sonatype researchers.
The jdb.js package included a script designed to perform basic reconnaissance of the infected machine and data gathering. The script attempted to download and execute a file named patch.exe that was used to install the njRAT remote access trojan.
Sonatype’s researcher Ax Sharma noticed that patch.exe loader also modified the local Windows firewall by adding a rule to whitelist its command and control (C&C) server before connecting it to download the final RAT.
The second package, jdb.js, only included the ode to load jdb.js.
“The package “db-json.js” appears clean on a first glance as it contains functional code one would expect from a genuine JSON DB creation package. Yet, it is secretly pulling in the malicious “jdb.js” as a dependency, something Sonatype has repeatedly warned about.” continues the analysis.
Developers that installed one of the above packages have to consider their systems as fully compromised.
“Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer.” states the npm staff.
“The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.”
The presence of malicious npm packages in the official repository is becoming frequent.
In early November, the same team of researchers discovered an npm package that contains malicious code designed to steal sensitive Discord and browser files.
The four packages, which had a total of one thousand of downloads, are:
This marks the fourth major takedown of a malicious package over the past three months.
In October, the npm team removed three packages that were also caught opening reverse shells (backdoors) on developer computers. The three packages were also discovered by Sonatype. Unlike the one discovered over the weekend, these three also worked on Windows systems, and not just UNIX-like systems.
(SecurityAffairs – hacking, npm)