New npm attack poisons local packages with backdoors

Two malicious packages were discovered on npm (Node package manager) that covertly patch legitimate, locally installed packages to inject a persistent reverse shell backdoor. This way, even if the victim removes the malicious packages, the backdoor remains on their system. The new tactic was discovered by researchers at Reversing Labs, who warned about the risk it entails, even if the packages weren't downloaded in large numbers. "It's not unusual to encounter downloaders on npm; they are maybe not as common as infostealers, but they are far from uncommon," explains Reversing Labs. "However, this downloader is worth discussing because of the exceptional strategies employed by the attackers to hide the malicious payload it delivered." The two packages discovered by Reversing Labs during routine security investigations on the open-source supply chain are 'ethers-provider2' and 'ethers-providerz.' The first package, which is still available on npm at the time of writing, is based on the popular 'ssh2' npm package but with a modified 'install.js' script that downloads a second-stage payload from an external source, which is executed and then deleted when finished to wipe all traces. The second stage monitors for the legitimate 'ethers' package, and once it finds it, it replaces the legitimate 'provider-jsonrpc.js' file with a trojanized version. The injected file now fetches a third-stage payload from the remote host, which enables a reverse shell using a modified SSH client, mi...