NPM flooded with malicious packages downloaded more than 86,000 times

According to Koi, attackers have exploited NPM’s Remote Dynamic Dependencies to flood the repository with 126 malicious packages that have been downloaded more than 86,000 times, with around 80 still available as of Wednesday morning. The campaign, tracked as PhantomRaven, used these packages to fetch dependencies from untrusted domains and even via HTTP, enabling the automatic installation of code that could exfiltrate data.

NPM’s practice allows installed packages to pull down and run unvetted code from untrusted sources, a weakness that was highlighted as a blind spot by the researchers. The dependencies were described as “invisible” to developers and many security scanners, and they were designed to download fresh payloads from the attacker server each time a package is installed rather than being cached or versioned.

The researchers noted that the exfiltration process relied on HTTP requests, JSON requests, and Websockets, and that the attackers could target different environments by serving different payloads based on IP address. NPM representatives didn’t immediately respond to requests for details.