Malicious B-tree NPM Package Accumulates Millions of Downloads
The NPM ecosystem has suffered another supply chain attack in which a malicious package has accumulated millions of downloads, Checkmarx reports.
Still ongoing, the campaign has managed to bypass NPM’s recent protections by hiding a malicious trigger in the package’s JavaScript prototype code, rather than using an install script that could be detected by security solutions.
Instead of targeting highly popular packages for fast propagation, and likely immediate detection, the threat actor built trust by creating a legitimate-looking GitHub repository.
The malicious package, indexed-btree, mimics the legitimate B-tree/indexing utility sorted-btree, and has reached 2 million weekly downloads before being detected, Checkmarx says.
To ensure the package’s popularity, the threat actor created a GitHub account and added seemingly legitimate commits to the indexed-btree repository.
“A GitHub repository is something that attackers don’t usually bother creating. This one is clever enough to not include the malicious code. Additionally, the presence of...
Copyright of this story solely belongs to www.securityweek.com. To see the full text click HERE
