Full Report
Two malicious NPM packages posing as WhatsApp development tools have been discovered deploying destructive data-wiping code that recursively deletes files on a developer's computers. [...]
Analysis Summary
# Tool/Technique: Malicious Fake WhatsApp Developer Libraries and Malicious Go Packages
## Overview
This summary covers two related threats detailed in the provided context: destructive code hidden within fake WhatsApp developer libraries and a set of malicious Go packages designed for remote execution and payload delivery, primarily targeting dependency confusion and typosquatting.
## Technical Details
- Type: Malware/Malicious Code Injection (Fake Libraries) / Malware (Malicious Go Packages)
- Platform: Likely targeting software development environments, potentially Linux CI servers and Windows workstations (for Go packages). The WhatsApp library code specifically targets the developer's local environment during the build/integration phase.
- Capabilities:
* **WhatsApp Libraries:** Targeted data wiping (`rm -rf *`) for developers, and dormant data exfiltration capabilities (phone number, device ID, status, hardcoded key).
* **Go Packages:** Obfuscated remote payload execution via spawned shells, fetching second-stage scripts/executables from C2 domains.
- First Seen: Not explicitly stated, but indicative of ongoing supply chain abuse discovered recently by Socket.
## MITRE ATT&CK Mapping
The identified actions map primarily to Supply Chain Compromise, Defense Evasion, and Execution tactics:
- **TA0001 - Initial Access** (Implied via dependency confusion/typosquatting)
- **T1195 - Supply Chain Compromise**
- T1195.002 - Compromise Software Supply Chain
- **TA0003 - Persistence** (Potentially if payloads establish persistence)
- **TA0002 - Execution**
- **T1059 - Command and Scripting Interpreter**
- T1059.004 - Unix Shell
- **TA0005 - Defense Evasion**
- **T1027 - Obfuscated Files or Information** (String-array obfuscation in Go packages)
- **TA0016 - Collection** (If the dormant WhatsApp exfiltration function were activated)
## Functionality
### Core Capabilities
- **Data Destruction (WhatsApp Library):** Execution of `rm -rf *` targeting the developer's current directory upon recognizing non-whitelisted (not developer-owned) phone numbers, serving as a highly destructive kill switch feature for non-whitelisted users.
- **Remote Payload Execution (Go Packages):** Malicious Go packages utilize string-array obfuscation to hide malicious execution logic. This logic spawns a shell to fetch and run a second-stage payload/script in memory.
### Advanced Features
- **Kill Switch Mechanism (WhatsApp Library):** The data-wiping functionality includes an exclusion list (based on phone numbers) acting as a targeted kill switch, ensuring the destructive capability only targets non-owner accounts.
- **Dormant Exfiltration (WhatsApp Library):** The code contains commented-out logic ('generateCreeds') for exfiltrating sensitive user/device data (phone number, device ID, status, hardcoded key).
- **Typosquatting (Go Packages):** Multiple malicious Go packages mimic legitimate names (e.g., `gouid`) to trick developers into installing them through confusion (dependency confusion technique).
## Indicators of Compromise
*Note: Specific hashes or IPs are not provided in the article, only package names and C2 suffixes.*
- File Hashes: [Not provided]
- File Names: [N/A - Injected library code or packages]
- Registry Keys: [Not applicable/Provided]
- Network Indicators: Second-stage payloads fetched from domains using **.icu** or **.tech** top-level domains.
- Behavioral Indicators:
* Dynamic download and execution of second-stage payloads at runtime.
* Spawning of shell processes (`sh` or equivalent).
* File system destruction (`rm -rf *` command execution).
## Associated Threat Actors
The context does not name specific threat actor groups but attributes the discovery to **Socket**. The actors behind these campaigns are sophisticated enough to employ obfuscation, typosquatting, and supply chain injection techniques.
## Detection Methods
- **Signature-based detection:** Detection relying on known C2 infrastructure using **.icu** or **.tech** domains for payload delivery if observed communicating with developer build systems. Detection of the specific string-array obfuscation patterns in Go binaries.
- **Behavioral detection:** Monitoring for processes spawned by development tools or compilers that subsequently initiate shell commands to download external content or execute file system deletion commands (`rm -rf`).
- **YARA rules if available:** Rules targeting the specific obfuscation techniques or the presence of the commented-out "generateCreeds" function within the WhatsApp libraries.
## Mitigation Strategies
- **Prevention measures:**
* Implement strict dependency vetting processes; never blindly trust packages downloaded from public repositories.
* Prefer using official, verified sources where possible.
* Utilize dependency pinning or lock files to prevent unexpected version upgrades that might introduce malicious code.
- **Hardening recommendations:**
* Never run build environments or CI/CD pipelines with excessive permissions. Environments should not have global write/delete access (e.g., root level access) to critical systems.
* Educate developers on spotting typosquatting and dependency confusion attempts.
## Related Tools/Techniques
- General Supply Chain Compromise techniques.
- Dependency Confusion attacks.
- Typosquatting in dependency management systems (npm, PyPI, Go Modules).