Cybersecurity researchers have identified three sets of malicious packages across the npm and Python Package Index (PyPI) repository that come with capabilities to steal data and even delete sensitive data from infected systems.
The list of identified packages is below –
- @async-mutex/mutex, a typosquat of async-mute (npm)
- dexscreener, which masquerades as a library for accessing liquidity pool data from decentralized exchanges (DEXs) and interacting with the DEX Screener platform (npm)
- solana-transaction-toolkit (npm)
- solana-stable-web-huks (npm)
- cschokidar-next, a typosquat of chokidar (npm)
- achokidar-next, a typosquat of chokidar (npm)
- achalk-next, a typosquat of chalk (npm)
- csbchalk-next, a typosquat of chalk (npm)
- cschalk, a typosquat of chalk (npm)
- pycord-self, a typosquat of discord.py-self (PyPI)
Supply chain security company Socket, which discovered the packages, said the first four packages are designed to intercept Solana private keys and transmit them through Gmail’s Simple Mail Transfer Protocol (SMTP) servers with the likely goal of draining victims’ wallets.
Particularly, the packages solana-transaction-toolkit and solana-stable-web-huks programmatically deplete the wallet, automatically transferring up to 98% of its contents to an attacker-controlled Solana address, while claiming to offer Solana-specific functionality.
“Because Gmail is a trusted email service, these exfiltration attempts are less likely to be flagged by firewalls or endpoint detection systems, which treat smtp.gmail.com as legitimate traffic,” security researcher Kirill Boychenko said.
Socket said it also came across two GitHub repositories published by the threat actors behind solana-transaction-toolkit and solana-stable-web-huks that purport to contain Solana development tools or scripts for automating common DeFi workflows, but, in reality, import the threat actor’s malicious npm packages.
The GitHub accounts associated with these repositories, “moonshot-wif-hwan” and “Diveinprogramming,” are no longer accessible.
“A script in the threat actor’s GitHub repository, moonshot-wif-hwan/pumpfun-bump-script-bot, is promoted as a bot for trading on Raydium, a popular Solana-based DEX, but instead it imports malicious code from solana-stable-web-huks package,” Boychenko said.
The use of malicious GitHub repositories illustrates the attackers’ attempts to stage a broader campaign beyond npm by targeting developers who might be searching for Solana-related tools on the Microsoft-owned code hosting platform.
The second set of npm packages have been found to take their malicious functionality to the next level by incorporating a “kill switch” function that recursively wipes all files in project-specific directories, in addition to exfiltrating environment variables to a remote server in some cases.
The counterfeit csbchalk-next package functions identically to the typosquatted versions of chokidar, the only difference being that it only initiates the data deletion operation after it receives the code “202” from the server.
Pycord-self, on the other hand, singles out Python developers looking to integrate Discord APIs into their projects, capturing Discord authentication tokens and connecting to an attacker-controlled server for persistent backdoor access post installation on both Windows and Linux systems.
The development comes as bad actors are targeting Roblox users with fraudulent libraries engineered to facilitate data theft using open-source stealer malware such as Skuld and Blank-Grabber. Last year, Imperva revealed that Roblox players on the lookout for game cheats and mods have also been targeted by bogus PyPI packages that trick them into downloading the same payloads.
