ChainVeil: A Malicious npm Supply Chain Attack by SuccessKey

Checkmarx

Overview: What We Found

Checkmarx Zero’s ongoing research into malicious open-source libraries has uncovered and reported a targeted supply chain campaign that bears strong indications of being operated by a threat actor known as “SuccessKey” (no apparent relationship to several companies of the same name).

As of this writing, all npm packages related to this campaign have been reported and taken down by npm; however, the nature of the campaign and the Command and Control (C2) system suggest a high probability that this campaign is ongoing and will see future attack attempts.

Our in…