Full Report
A newly discovered malware campaign uses malicious npm packages to deploy reverse shells, compromising development environments
Analysis Summary
# Tool/Technique: Malicious npm Packages (ethers-provider2 and ethers-providerz)
## Overview
A malware campaign utilizing malicious packages uploaded to the npm (Node Package Manager) registry to deliver sophisticated, multi-stage reverse shells onto development environments. These packages covertly modify legitimate dependencies to establish persistent remote access.
## Technical Details
- Type: Malware (Reverse Shell delivery mechanism via compromised dependencies)
- Platform: JavaScript/Node.js dependent environments (specifically targeting users of the `ethers` package ecosystem)
- Capabilities: Dependency confusion/hijacking, multi-stage payload delivery, file system modification, establishing reverse shell connections.
- First Seen: Undefined (Recently discovered campaign)
## MITRE ATT&CK Mapping
- T1588 - Obtain Capabilities
- T1588.002 - Obtain Capabilities: Tool
- T1189 - Drive-by Compromise (Applicable in the initial supply chain infection vector)
- T1059 - Command and Scripting Interpreter
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- TA0008 - Lateral Movement (Implied, for initial access)
- TA0011 - Command and Control
- T1071 - Application Layer Protocol
- T1071.001 - Application Layer Protocol: Web Protocols (Implied, for C2 communication)
## Functionality
### Core Capabilities
- **Initial Compromise (ethers-provider2):** Mimics the legitimate `ssh2` package and embeds malicious code within its installation script (`postinstall` or similar lifecycle hook).
- **Second-Stage Download:** The initial script downloads a second-stage payload from an external Command and Control (C2) server.
- **Trace Erasing:** The initial execution script deletes the evidence of the download.
- **Persistence Mechanism:** The second-stage payload monitors the file system for the installation of the legitimate `ethers` package.
- **Backdoor Installation:** Upon detecting the `ethers` package, it replaces a key file within `@ethersproject/providers` with a compromised version.
### Advanced Features
- **Multi-Stage Payload Delivery:** Uses three distinct stages to execute the final malicious component, increasing evasion complexity.
- **Dependency Hijacking:** Targets developers using popular libraries by creating packages with names very similar to legitimate ones (`ethers-provider2` mimicking dependencies related to `ethers`, and `ethers-providerz`).
- **Resilience/Persistence:** The infection persists even if the initial malicious package is removed, as the third-stage payload is installed deep within a legitimate, frequently reinstalled dependency (`ethers`).
- **Reverse Shell Establishment:** The final payload establishes a persistent connection back to the attacker's infrastructure.
## Indicators of Compromise
- File Hashes: [Not specified in the text]
- File Names:
- Malicious packages: `ethers-provider2`, `ethers-providerz`
- Targeted replacement location: A key file within `@ethersproject/providers`
- Registry Keys: [Not applicable/Specified]
- Network Indicators:
- External server hosting the second-stage payload (C2)
- Attacker’s server receiving the established reverse shell connection
- Behavioral Indicators:
- Execution of installation scripts upon `npm install`.
- File system modification within the `node_modules` structure, specifically patching files related to `@ethersproject/providers`.
- Outbound network connections to retrieve secondary payloads and establish interactive shells.
## Associated Threat Actors
- Undisclosed attackers responsible for the campaign discovered by ReversingLabs.
## Detection Methods
- Signature-based detection: Identifying known malicious npm package names (`ethers-provider2`, `ethers-providerz`) or anomalous network traffic patterns corresponding to payload downloads.
- Behavioral detection: Monitoring installation hooks (`preinstall`, `postinstall` scripts) in npm packages for suspicious file downloads or system modifications within development directories.
- YARA rules: Potentially rule development targeting specific strings or code structures hidden within the npm package contents that match the reverse shell logic.
## Mitigation Strategies
- **Supply Chain Security:** Implement thorough vetting and automated analysis for all public and private dependencies added to projects.
- **Dependency Auditing:** Use tools to audit dependency trees for suspicious package names or known malicious dependencies before installation or deployment.
- **Least Privilege:** Ensure build/development environments operate with the lowest necessary privileges to limit the damage from post-installation scripts.
- **Network Segmentation:** Restrict outbound connections from build servers to only necessary, whitelisted destinations.
## Related Tools/Techniques
- Dependency confusion attacks (similar supply chain vector).
- Other repository hijacking incidents (e.g., PyPI or Maven dependency poisoning).