Scavenger Malware Compromises Well-liked npm Packages to Goal Builders

The well-known npm bundle eslint-config-prettier was launched with out authorization, based on a number of GitHub customers, although its repository didn’t comprise any corresponding code modifications.

The maintainer later confirmed through social media that their npm account was compromised by way of a phishing e-mail, affecting a number of packages together with eslint-config-prettier variations 8.10.1, 9.1.1, 10.1.6, and 10.1.7; eslint-plugin-prettier variations 4.2.2 and 4.2.3; snyckit model 0.11.9; @pkgr/core model 0.2.8; and napi-postinstall model 0.3.1.

Compromise Particulars

This supply-chain assault distributed a novel malware dubbed “Scavenger” attributable to recurring strings like “SCVNGR” in its variants.

The an infection vector targets Home windows methods through an set up.js script within the compromised packages, which executes a operate known as logDiskSpace.

This operate checks for the win32 platform and spawns a baby course of utilizing rundll32.exe to load a malicious DLL named node-gyp.dll, hashed as c68e42f416f482d43653f36cd14384270b54b68d6496a8e34ce887687de5b441.

Compiled on the identical day because the bundle distribution, this DLL acts as a loader, initiating a separate thread for its core operations.

The phishing marketing campaign itself, involving system code methods, was detailed individually by safety researcher Rad in a writeup on npm supply-chain assaults, highlighting how attackers gained preliminary entry.

Malware Evaluation

Scavenger’s loader, written in Visible Studio C++, employs subtle anti-analysis measures to evade detection.

In line with the Report, it performs anti-VM checks by querying the uncooked SMBIOS firmware desk through GetSystemFirmwareTable, scanning for signatures like “VMware”, “qemu”, or “QEMU”.

Extra defenses embrace enumerating course of modules for antivirus-related DLLs resembling snxhk.dll (Avast), SbieDll.dll (Sandboxie), and cmdvrt32.dll (Comodo), in addition to instruments like vehdebug-x86_64.dll (CheatEngine).

It verifies system attributes, making certain greater than three processors through NtQuerySystemInformation and confirming non-console execution with WriteConsoleW. If any examine fails, it induces a null-pointer crash.

The malware dynamically resolves capabilities utilizing a CRC32 hashing routine on loaded modules from the Course of Surroundings Block (PEB), changing Unicode DLL names to ASCII and computing hashes with out caching for added obfuscation.

It unhooks APIs like NtSetInformationThread and NtQuerySystemInformation through oblique syscalls, patching directions to bypass EDR hooks. Strings are encrypted with XOR keys like 0x39541b2f8f3ef92d and decrypted on-the-fly.

Communications with command-and-control (C2) servers use libcurl and XXTEA encryption (identifiable by DELTA 0x9e3779b9), sending base64-encoded payloads to endpoints like /c/k2 for marketing campaign IDs and /c/v for integrity checks.

The second-stage stealer mirrors these methods, focusing on Chromium artifacts resembling Extensions, ServiceWorkerCache, DawnWebGPUCache, and Visited Hyperlinks for knowledge exfiltration, probably harvesting authentication tokens, session knowledge, or shopping historical past.

Variants hyperlink to prior campaigns, together with a BeamNG executable an infection, with slip-ups like uncovered PDB paths (C:UsersuserDesktopXscavengerscavenger-mainscavenger-clientx64Releasedropper-cmd.pdb) confirming the “Scavenger” title and sloppy WinExec calls executing curl instructions to fetch further payloads.

Indicators of Compromise

Get Free Final SOC Necessities Guidelines Earlier than you construct, purchase, or swap your SOC for 2025 - Obtain Now