Full Report
Cryptomining malware hits popular npm packages rspack and vant, posing risks to open source tools
Analysis Summary
# Incident Report: Open Source Supply Chain Compromises Targeting Cryptomining Malware
## Executive Summary
Security researchers uncovered a series of supply chain attacks targeting popular open source JavaScript packages, specifically `rspack` and `vant`, leading to the installation of XMRig cryptomining malware. The attackers utilized stolen npm access tokens to upload malicious versions of the packages, impacting hundreds of thousands of weekly users. Response efforts involved the swift removal of compromised versions and replacement with patched releases.
## Incident Details
- Discovery Date: Late December 2024 (Implied close to publication on Dec 23, 2024)
- Incident Date: Varied, spanning the period when compromised versions were uploaded.
- Affected Organization: Developers and end-users consuming packages from the npm registry, specifically maintainers of `rspack` and `vant`.
- Sector: Software Development / Tech
- Geography: Global (npm distribution)
## Timeline of Events
### Initial Access
- Date/Time: Pre-discovery, time unknown.
- Vector: Stolen npm Access Tokens.
- Details: Attackers successfully acquired valid authentication tokens for the npm accounts associated with the affected packages.
### Lateral Movement
- *Not explicitly detailed.* The primary method focused on direct modification of published package versions on the trusted third-party repository (npm), negating the need for traditional network lateral movement within victims' environments.
### Data Exfiltration/Impact
- Data Impact: Installation and execution of XMRig cryptomining malware to leverage victim CPU resources for cryptocurrency mining (likely Monero/XMR).
### Detection & Response
- Detection: Security researchers (ReversingLabs) uncovered the breaches, likely through package monitoring or differential analysis of package versions.
- Response Actions:
- **rspack:** Compromised versions (@rspack/core and @rspack/cli versions 1.1.7) were swiftly removed and replaced with clean version 1.1.8.
- **vant:** Compromised versions (spanning 2.13.3 to 4.9.14) were patched, with a clean update released as version 4.9.15.
## Attack Methodology
- Initial Access: Stolen **npm tokens**. (Similar incidents noted leveraged GitHub Actions Script Injection and stolen PyPI API tokens).
- Persistence: Installation of the cryptominer payload within the package contents, designed to execute upon installation/use of the library.
- Privilege Escalation: Not applicable (Attack focused on compromising the *publisher* account, not escalation within victim endpoints).
- Defense Evasion: Use of **obfuscated code** within the malicious package components.
- Credential Access: N/A (The attack vector *was* stolen supply chain credentials/tokens).
- Discovery: N/A (Attacker reconnaissance focused on targeting popular packages).
- Lateral Movement: N/A (Focused on supply chain injection).
- Collection: N/A (Primary goal was CPU utilization for mining).
- Exfiltration: N/A (No data exfiltration observed; impact was resource theft).
- Impact: Resource exhaustion via cryptomining (XMRig).
## Impact Assessment
- Financial: Indirect costs related to CPU usage, incident response time, and developer trust remediation. Potential financial impact for end-users running the malware.
- Data Breach: Not reported as a direct data breach; impact was resource hijacking (cryptomining).
- Operational: Potential performance degradation on developer machines or build servers utilizing the compromised packages.
- Reputational: Increased scrutiny on the security posture of the npm ecosystem and the specific projects involved.
## Indicators of Compromise
- Network Indicators: Unauthorized communication with external servers (specific URLs/IPs were obfuscated and not provided in detail).
- File Indicators: Presence of new files containing obfuscated JavaScript code.
- Behavioral Indicators: Execution of unauthorized code upon package installation/use; CPU usage spike indicative of cryptomining.
## Response Actions
- Containment: Swift removal of malicious package versions from the npm registry.
- Eradication: Developers rolling back to clean, verified package versions, potentially purging build caches.
- Recovery: Release of patched versions (rspack 1.1.8, vant 4.9.15).
## Lessons Learned
- The reliability of centralized package managers (like npm) is critically dependent on the security of publishing credentials (access tokens).
- Attackers are actively exploiting supply chains to distribute commodity malware like XMRig cryptominers.
- Differential analysis comparing successive package versions is an effective detection mechanism for spotting latent malicious changes.
## Recommendations
- Implement stricter authentication controls (e.g., MFA) on all package publishing accounts and API tokens.
- Utilize automated tools for monitoring package updates, cross-referencing version changes for obfuscation or suspicious network calls *before* deployment in production environments.
- Enforce least-privilege access for publishing rights to source code repositories and package managers.
- Developers should conduct regular differential analysis on critical dependencies, especially between minor/patch versions, to detect anomalies.