Full Report
Two malicious packages have been discovered in the npm JavaScript package index, which masquerades as useful utilities but, in reality, are destructive data wipers that delete entire application directories. [...]
Analysis Summary
# Tool/Technique: Malicious npm Packages (Data Wipers)
## Overview
Malicious data-wiping packages recently discovered in the npm registry, designed to delete project directories upon execution. These appear motivated by sabotage or state-level disruption rather than typical financial gain. They integrate into projects via dependency confusion or typosquatting attacks, posing as legitimate utilities.
## Technical Details
- Type: Malware / Sabotage Tool
- Platform: Software development environments utilizing Node.js/npm. (Implied to target project infrastructure)
- Capabilities: Remote command execution, targeted data destruction (file/directory deletion) based on OS.
- First Seen: Not explicitly mentioned in the provided text, but recent discovery context implies contemporary threat.
## MITRE ATT&CK Mapping
The primary action of the malware is data destruction.
- **TA0004 - Privilege Escalation** (Often required for sufficient access to delete project files, though not explicitly detailed if elevation occurs)
- **TA0006 - Credential Access** (Not applicable/Observed)
- **TA0011 - Command and Control**
- T1041 - Exfiltration Over C2 Channel (Used for communication/confirmation)
- **TA0012 - Impacts**
- T1485 - Data Destruction
- T1485.001 - Input Capture (Less likely, but deletion itself is the impact)
***Note on Specific Techniques***: The deletion mechanism directly maps to **T1485 - Data Destruction**. The communication back to the attacker maps to C2 techniques. The text also mentions specific backdoor endpoints typically associated with more sophisticated malware or C2 frameworks, suggesting the package serves as a remote-controlled wiper.
## Functionality
### Core Capabilities
- **Reconnaissance**: Triggers reconnaissance actions upon execution.
- **OS-Specific Destruction**: Executes `rm -rf *` on Linux systems and `rd /s /q .` on Windows systems to delete the current directory contents.
- **Remote Activation**: Requires a secret key ('HelloWorld', in the example discussed) to trigger the deletion payload.
### Advanced Features
- **Backdoor Endpoints**: Registers specific HTTP endpoints for communication/control:
- `GET /_/system/health` (returns server status)
- `POST /_/system/health` (primary destruction endpoint)
- `POST /_/sys/maintenance` (backup destruction endpoint)
- **Confirmation Email**: Emails the attacker (`[email protected]`) with the backend URL, system fingerprint, and confirmation of the wipe result.
- **Real-time Feedback**: Sends immediate confirmation feedback via HTTP response to the original requestor.
## Indicators of Compromise
- File Hashes: [N/A in text]
- File Names: [The names of the malicious npm packages themselves]
- Registry Keys: [N/A in text]
- Network Indicators:
- C2/Confirmation Email Recipient: anupm019 [at] gmail [dot] com
- Backdoor Endpoints: `/_/system/health`, `/_/sys/maintenance`
- Behavioral Indicators: Execution of `rm -rf *` or `rd /s /q .` within project directories following package installation; outbound email/HTTP communication to specified C2 addresses upon successful destruction.
## Associated Threat Actors
- Motivated by: Sabotage, competition, or state-level disruption.
- Specific Actors: Not explicitly named, but the nature suggests state-sponsored or highly motivated malicious actors targeting development environments.
## Detection Methods
- Signature-based detection: Detecting known package names (if published).
- Behavioral detection: Monitoring for the execution of system file deletion commands (`rm -rf`, `rd /s /q`) originating from JavaScript processes (Node.js/npm). Detecting outbound communication to the known confirmation email address or specific C2 activity patterns.
- YARA rules: [N/A in text]
## Mitigation Strategies
- **Dependency Verification**: Thoroughly vet all third-party dependencies before adding them to production codebases, even from trusted repositories like npm.
- **Least Privilege**: Ensure development/build systems operate with the minimum necessary permissions to prevent widespread damage from package execution.
- **Automated Scanning**: Employ Software Composition Analysis (SCA) tools to scan dependencies for malicious behavior patterns.
- **Air-Gapped/Private Registries**: Use internal or private registries for critical dependencies where possible.
## Related Tools/Techniques
- Dependency Confusion/Typosquatting: The likely infection vectors used to introduce these packages.
- Other npm/PyPI Wipers (e.g., event-stream in the past, which served a different purpose but exploited the supply chain).