July 2023 Summaries

Socket has introduced a free browser extension designed to enhance the security and quality assessment of packages on NPM by adding Socket package metrics directly to NPM package and search pages. Available for Chrome, Firefox, and other Chromium-based browsers, the extension analyzes potential vulnerabilities and unwanted behaviors across the entire dependency tree, providing users with a means to verify the trustworthiness of NPM packages before installation. It highlights packages with low Socket scores that may pose risks to open-source supply chains, offering alternative recommendations with better security metrics. Additionally, Socket plans to extend support to Safari and other package repositories like PyPI, while also encouraging users to install their GitHub app for broader project security.

A sophisticated social engineering campaign by the North Korean state-sponsored Lazarus Group, also known as Jade Sleet and TraderTraitor, targets developers in the cryptocurrency and cybersecurity sectors using malware-laden npm packages. The group's tactics involve creating fake developer or recruiter profiles on platforms like GitHub, LinkedIn, and Slack, and sometimes hijacking real accounts to lure tech professionals into collaborating on GitHub repositories, which contain malicious npm dependencies. Once a target clones and executes the repository content, the npm packages serve as first-stage malware that fetches additional malware to compromise the victim's system. GitHub's analysis highlights this multi-step attack chain, emphasizing the need for vigilance and the use of security tools like Socket, which offers deep package inspection and real-time monitoring to detect and block such threats. This campaign has been identified as supporting North Korean objectives, primarily targeting individuals and organizations related to cryptocurrency and blockchain, with measures suggested for developers to protect themselves, including scrutinizing new packages, alerting security teams, and resetting potentially affected devices.

Vulnerability scanners based on Common Vulnerabilities and Exposures (CVEs) often provide a false sense of security and fail to prevent supply chain attacks, as demonstrated by incidents involving `ua-parser-js`, `event-source-polyfill`, and `event-stream`. These incidents highlight the limitations of relying solely on traditional Software Composition Analysis (SCA) tools that focus on known vulnerabilities, as they were unable to detect attacks such as unauthorized access and malicious code insertion. The `ua-parser-js` incident involved attackers publishing harmful package versions, while the maintainer of `event-source-polyfill` used the library to express political views, and the `event-stream` incident saw a new maintainer introduce a stealthy payload to steal funds. These cases underscore the need for proactive security measures, such as behavioral analysis tools like Socket, which analyze the behavior of dependencies, providing a more comprehensive approach to detecting and preventing complex supply chain threats.