Scavenger Malware Compromises Widespread npm Packages to Goal Builders

The well-known npm package deal eslint-config-prettier was launched with out authorization, in keeping with a number of GitHub customers, despite the fact that its repository didn’t comprise any corresponding code adjustments.

The maintainer later confirmed through social media that their npm account was compromised by means of a phishing e-mail, affecting a number of packages together with eslint-config-prettier variations 8.10.1, 9.1.1, 10.1.6, and 10.1.7; eslint-plugin-prettier variations 4.2.2 and 4.2.3; snyckit model 0.11.9; @pkgr/core model 0.2.8; and napi-postinstall model 0.3.1.

Compromise Particulars

This supply-chain assault distributed a novel malware dubbed “Scavenger” attributable to recurring strings like “SCVNGR” in its variants.

The an infection vector targets Home windows programs through an set up.js script within the compromised packages, which executes a operate known as logDiskSpace.

This operate checks for the win32 platform and spawns a toddler course of utilizing rundll32.exe to load a malicious DLL named node-gyp.dll, hashed as c68e42f416f482d43653f36cd14384270b54b68d6496a8e34ce887687de5b441.

Compiled on the identical day because the package deal distribution, this DLL acts as a loader, initiating a separate thread for its core operations.

The phishing marketing campaign itself, involving system code strategies, was detailed individually by safety researcher Rad in a writeup on npm supply-chain assaults, highlighting how attackers gained preliminary entry.

Malware Evaluation

Scavenger’s loader, written in Visible Studio C++, employs subtle anti-analysis measures to evade detection.

In accordance with the Report, it performs anti-VM checks by querying the uncooked SMBIOS firmware desk through GetSystemFirmwareTable, scanning for signatures like “VMware”, “qemu”, or “QEMU”.

Extra defenses embody enumerating course of modules for antivirus-related DLLs equivalent to snxhk.dll (Avast), SbieDll.dll (Sandboxie), and cmdvrt32.dll (Comodo), in addition to instruments like vehdebug-x86_64.dll (CheatEngine).

It verifies system attributes, guaranteeing greater than three processors through NtQuerySystemInformation and confirming non-console execution with WriteConsoleW. If any examine fails, it induces a null-pointer crash.

The malware dynamically resolves capabilities utilizing a CRC32 hashing routine on loaded modules from the Course of Surroundings Block (PEB), changing Unicode DLL names to ASCII and computing hashes with out caching for added obfuscation.

It unhooks APIs like NtSetInformationThread and NtQuerySystemInformation through oblique syscalls, patching directions to bypass EDR hooks. Strings are encrypted with XOR keys like 0x39541b2f8f3ef92d and decrypted on-the-fly.

Communications with command-and-control (C2) servers use libcurl and XXTEA encryption (identifiable by DELTA 0x9e3779b9), sending base64-encoded payloads to endpoints like /c/k2 for marketing campaign IDs and /c/v for integrity checks.

The second-stage stealer mirrors these strategies, focusing on Chromium artifacts equivalent to Extensions, ServiceWorkerCache, DawnWebGPUCache, and Visited Hyperlinks for knowledge exfiltration, doubtlessly harvesting authentication tokens, session knowledge, or shopping historical past.

Variants hyperlink to prior campaigns, together with a BeamNG executable an infection, with slip-ups like uncovered PDB paths (C:UsersuserDesktopXscavengerscavenger-mainscavenger-clientx64Releasedropper-cmd.pdb) confirming the “Scavenger” identify and sloppy WinExec calls executing curl instructions to fetch further payloads.

Indicators of Compromise

Get Free Final SOC Necessities Guidelines Earlier than you construct, purchase, or swap your SOC for 2025 - Obtain Now