DPRK Launches Malicious NPM Package Factory

North Korea’s ‘Contagious Interview’ campaign to target job seekers has expanded yet again, this time with a persistent npm package-poisoning game that runs like a well-oiled machine. Threat actors have delivered more than 197 malicious npm packages with more than 31,000 collective downloads since Oct. 10, as part of ongoing state-sponsored activity to lure and compromise software development professionals.

In the latest wave of the campaign, which has been ongoing for at least several years now, North Korean threat actors are targeting blockchain and Web3 developers through fake job interviews and “test assignments,” according to a report published this week by Socket Threat Research. 

Since at least June, they have added the delivery of malicious npm packages to the targets that are designed to deliver initial access malware; attackers thus gain the ability to deliver further payloads, install a remote access Trojan (RAT), and steal credentials and cryptocurrency. 

Moreover, attackers consistently have been creating and uploading malicious packages through a GitHub infrastructure that underpins at least a part of the activity. So far, Socket has discovered hundreds of malicious npm packages that cumulatively have been downloaded tens of thousands of times.

Related:Prompt Injections Loom Large Over ChatGPT’s Atlas Browser

“This sustained tempo makes Contagious Interview one of the most prolific campaigns exploiting npm, and it shows how thoroughly North Korean threat actors have adapted their tooling to modern JavaScript and crypto-centric development workflows,” Socket Threat Research’s Kirill Boychenko wrote in the report.

Unpacking Malware & DPRK Attacker Infrastructure 

The Contagious Interview campaign begins with a ruse that lures victims via social media, such as LinkedIn, posing as recruiters or hiring managers offering employment positions. Their ultimate objective is to compromise the machines of developers that are likely to hold credentials, private keys, tokens, and other monetizable secrets, according to Socket.

At some point, job candidates are asked to do a “test” by working on a fake project, which is where the malicious npm packages enter the attack flow. The latest malicious npm packages deliver a variant of the OtterCookie malware, which combines BeaverTail malware and prior versions of OtterCookie, according to Socket. BeaverTail is malware that often serves as a downloader of further payloads, while OtterCookie is a multistage infostealer and RAT.

The malware establishes a command-and-control (C2) channel to provide the attackers with a remote shell, and the ability to deliver second-stage malware. It also has capabilities to steal clipboard contents, log keystrokes, capture screenshots, and gather browser credentials, documents, cryptocurrency wallet data, and seed phrases, according to Socket.

Related:Infamous Shai-hulud Worm Resurfaces From the Depths

Using GitHub as a Foundation for Malicious Activity

Socket researchers also discovered GitHub infrastructure powering the delivery of malicious packages by tracing one of them — a package called tailwind-magic —  back to its source. This led them to a Vercel-hosted staging endpoint, tetrismic[.]vercel[.]app, and from there to a threat actor-controlled GitHub account, stardev0914, which contained 18 repositories. The team collaborated with Kieran Miyamoto of the DPRK Research blog to uncover the GitHub account.

“The repositories … form a coherent adversarial delivery stack: malware-serving code lives on GitHub, the latest payload is fetched from Vercel, and a separate C2 server handles data collection and tasking,” Boychenko wrote, adding that at least five of the malicious npm packages delivered in the campaign rely on this infrastructure to deliver a second-stage payload.

This consistent and persistent use of GitHub as a foundation for the campaign is what sets it apart from other malicious npm package campaigns, which are becoming all too common, observes Collin Hogue-Spears, senior director of solution management at application security solution provider Black Duck.

Related:LINE Messaging Bugs Open Asian Users to Cyber Espionage

“Previous npm attacks were ‘smash and grab’ in nature: compromise one package, cash out, and disappear,” he tells Dark Reading. “This new campaign, on the other hand, runs continuously. They ship malware in a similar fashion to legitimate teams shipping features.”

Indeed, the systematic longevity of the campaign sets it apart from other malicious package attacks, concurs Jason Soroko, senior fellow at comprehensive certificate lifecycle management (CLM) provider Sectigo. 

“The level of persistence, the combination of social engineering and supply chain abuse, and the detailed visibility into their GitHub and Vercel workflow, make this look less like a one-off hijack and more like a standing product operation,” he says.

Making Developer Environments Cyber-Safe

At this time, the stardev0914 account is no longer active on GitHub; however, DPRK attackers are quickly regrouping and forming other accounts from which to conduct their malicious activity, “with fresh npm infiltrations emerging weekly,” Boychenko warned.

Indeed, npm packages will continue to be a popular attack surface to poison the software supply chain for the foreseeable future, experts say, because of the nature of the development platform, experts say.

“Npm’s architecture was built for velocity, not to defend against adversaries,” Hogue-Spears notes. “This was a rational trade-off a decade ago, but not anymore because the same design turns every npm install into a potential remote code execution (RCE), and nation-state actors have noticed.”

To defend the software supply chain, organizations should consider dependency governance a top-level security discipline, with more insight into what packages are being used and more scrutiny of maintainers and their actions, observes Randolph Barr, chief information security officer (CISO) at API security firm Cequence Security. 

“Using contemporary … risk tools to detect problems like obfuscated code, post-install hooks, unexpected maintainers, or strange network activity is an important part of the package selection process,” and can help serve the overall goal to make developer environments safer, he says.