April 2023 Summaries

Malicious packages on the Python Package Index (PyPI), namely checker-SaGaF, steinlurks, and sinnercore, target TikTok and Instagram accounts by validating stolen emails against the platforms' APIs, posing significant supply chain security risks. These packages operate as automated tools, known as checkers, to test large volumes of stolen usernames or emails against login interfaces, identifying valid account combinations. By leveraging internal API endpoints and simulating legitimate app behavior, these packages enable threat actors to validate email addresses and confirm account existence, paving the way for further cyber exploits such as doxing, spamming, and credential stuffing attacks. The validated user lists are often sold on the dark web, with personal information being commoditized at alarmingly low prices. The presence of these packages underscores the importance of safeguarding personal information and awareness of potential vulnerabilities in software environments, urging developers to scrutinize error messages and take preventive measures against unauthorized access.

Socket's blog discusses the newly released npm provenance feature provided by GitHub, which is designed to enhance transparency and traceability in the npm registry through code signing. This feature does not inherently make code safer but allows for the verification of a package's origin, linking it to specific GitHub actions and providing attestations about the software's provenance. Using the sigstore standard workflow, npm correlates publishing data with known computing infrastructure metadata, ensuring that code originates from a trusted environment. The provenance data, currently based on GitHub actions, is expected to expand, and npm's `--provenance` flag facilitates the transmission of environmental data for verification purposes. Although code signing does not analyze or ensure the safety of the code itself, it provides a way to trace the source of any potentially malicious scripts and better connects the social graph to GitHub, offering potential for improved auditing and accountability.

The "Skeleton Squad," also known as "EsqueleSquad," has expanded its malicious activities from the Python Package Index (PyPI) to the npm ecosystem, posing a significant threat to developers and users of JavaScript package managers like npm, yarn, and pnpm. Initially appearing in February, this threat actor has been deploying harmful packages that drop malicious executables, with the latest being an npm package called `pyautodllxd`. Despite not impersonating popular packages, this package executes a PowerShell command targeting Windows systems, downloading a trojan marked by several vendors. The executable employs sophisticated techniques to bypass Windows Defender, using a script that exploits the CMSTP bypass technique. This approach mirrors their previous PyPI tactics, involving a Base64-encoded PowerShell command that initiates the download of a remote executable, leading to the deployment of multiple malware binaries. Despite efforts by security teams to remove these threats, the Skeleton Squad continues to exploit user accounts, even leaving cryptic messages in Spanish, suggesting a persistent and evolving cyber threat.

Socket is actively participating in the 2023 BSidesSF and RSA Conference, marking its debut as a sponsor at BSidesSF. The team invites attendees to visit their booth in the CTF area, participate in sessions, and enjoy limited edition swag. Additionally, Socket has arranged a cozy lounge near the Moscone Conference Center, offering a relaxing space with local food and beverages, where visitors can meet the team and collect exclusive Socket merchandise. For those interested in more personalized interactions, one-on-one meetings can be scheduled through a direct booking link or by emailing the team.

Socket's npm wrapper recently underwent a feedback phase to gather user insights on its functionality and areas needing improvement. While aliasing `npm` to `socket-npm` improved usability, it also revealed challenges like the need for global installations and the handling of shell tooling. To minimize confusion in error messages, the team is exploring message prefixing, and a new update notification banner has been added to ensure users keep both `npm` and Socket's CLI current. Issues with install scripts and the need for more user-friendly configurations were noted, prompting exploration into features such as an IPC server for better prompt handling. Feature requests include support for alternative package managers, telemetry, organization settings, and improved secondary integrations, which are all being actively considered. As the feedback phase concludes, Socket plans to integrate these insights and continue evolving the product based on user input.

A malicious Python package named "pycord-self" has been identified by Socket researchers as targeting Discord developers by impersonating the legitimate "discord.py-self" library, a popular Python wrapper for the Discord user API. This fraudulent package uses a typosquatting strategy, deceiving developers into installing it, which then allows attackers to steal Discord authentication tokens and establish a backdoor for remote access to users' systems. The malicious package, unlike its reputable counterpart, has significantly fewer downloads and falsely claims a different maintainer. It was discovered that the package could exfiltrate tokens to a malicious URL and create a persistent backdoor connection to a remote server, posing substantial security risks to developers who inadvertently use it. The incident underscores the importance of verifying the authenticity and popularity of dependencies before installation, using package scanning tools, and regularly auditing and updating dependencies to prevent the inclusion of malicious packages.

Socket has launched Project Health Reports, a feature designed to provide security teams with comprehensive insights into the health of entire projects by analyzing supply chain risks, quality, maintenance, and license issues within GitHub repositories. Unlike real-time Socket Alerts meant for developers, these reports offer a detailed overview of dependencies and potential risks, allowing security teams to audit and address issues holistically. Developers benefit indirectly as security information is communicated to them via GitHub integration, enabling them to resolve issues independently. The reports can be filtered by severity or type of issue, aiding in prioritizing critical concerns. Advanced navigation tools within the report help teams identify and manage dependencies with unacceptable risks, such as known malware or protestware, potentially earmarking them for removal in the long term.