Malicious Npm Packages Abuse Adspect Redirects To Evade Security
Seven packages published on the Node Package Manager (npm) registry use the Adspect cloud-based service to separate researchers from potential victims and lead them to malicious locations.
The purpose of the attack is to lead victims to cryptocurrency scam sites, according to an analysis from researchers at application security company Socket.
All malicious packages were published under the developer namee ‘dino_reborn’ (geneboo@proton[.]me) between September and November. However, six of them contain malicious code while the seventh is used to build a malicous webpage:
The researchers say that signals-embed is not inherently malicious and contains only the code to create a white decoy webpage. The other six have code that collects data about the visitors to determine if the traffic comes from a researcher or from a potential victim.
This is achieved by collecting information from the browser environment, such as browser identifiers, page and URL data, host and hostname of the current page, and prepares it for sending to Adspect’s API.
The six malicious packages contain a 39kB code that features the cloaking mechanism, Socket researchers note, adding that the code executes automatically on page load without extra user action, due to Immediately Invoked Function Expression (IIFE) wrapping.
The attack executes when the compromised developer’s web application loads the malicious JavaScript in a browser.
According to Socket, the injected code features anti-analysis such as blocking right-click, F12, Ctrl+U, Ctrl+Shift+I, and reloading the page if DevTools is detected. This makes it more difficult for security researchers to inspect the webpage.
The script gathers the visitor’s user agent, host, referrer, URI, query string, protocol, language, encoding, timestamp, and accepted content types, and sends the fingerprinting data to a threat actor proxy.
The real victim’s IP address is retrieved and forwarded to the Adspect API, which then evaluates the data to classify the visitor.
Source: BleepingComputer
