CP
cyberpings

Malicious Strapi NPM Packages Target Guardarian Users

SeverityHIGH

Significant risk — action recommended within 24-48 hours

Featured image for Malicious Strapi NPM Packages Target Guardarian Users
SWSecurityWeek·Reporting by Ionut Arghire
Summary by CyberPings Editorial·AI-assisted·Reviewed by Rohit Rana
Ingested:
🎯

Basically, hackers created fake Strapi plugins to steal information from users.

Quick Summary

Hackers have targeted Strapi users with 36 malicious NPM packages. This attack aims to steal credentials and execute unauthorized commands. Guardarian users are especially at risk, prompting urgent security measures.

What Happened

A recent supply chain attack has compromised the Strapi ecosystem, with hackers publishing 36 malicious NPM packages. These packages, disguised as Strapi plugins, were identified by the security firm SafeDep. They are capable of executing various malicious payloads that can lead to severe security breaches.

How It Works

The malicious packages deliver a range of harmful functionalities, including:

  • Redis code execution
  • Docker container escape
  • Credential harvesting
  • Reverse shell deployment
    One of the notable payloads exploits Redis instances, allowing attackers to inject crontab entries and deploy webshells. Another payload targets Docker containers, enabling unauthorized access to host directories and sensitive information.

Who's Being Targeted

This campaign specifically targets users of the cryptocurrency payment gateway Guardarian. The attackers demonstrated a clear understanding of the Guardarian ecosystem, probing its databases and utilizing a Guardarian API module in their attacks.

Signs of Infection

Users who have installed these malicious packages might notice unusual activity, such as:

  • Unexpected reverse shell connections
  • Unauthorized access attempts to databases
  • Changes to configuration files

How to Protect Yourself

If you suspect you have installed any of these malicious NPM packages, take immediate action:

  1. Rotate all credentials, including database passwords and API keys.
  2. Monitor your systems for unusual activity or unauthorized access.
  3. Remove any suspicious packages from your environment.
  4. Stay updated on security advisories related to Strapi and NPM packages.

What You Should Do

SafeDep advises all users of Strapi to be vigilant. The targeted nature of this attack highlights the importance of using trusted packages and regularly auditing dependencies. By rotating credentials and monitoring for suspicious activity, users can mitigate the risks posed by these malicious packages.

🔒 Pro insight: The targeted approach of this attack underscores the necessity for developers to scrutinize package sources and maintain strict dependency management.

Original article from

SWSecurityWeek· Ionut Arghire
Read Full Article

Share

Related Pings

HIGHMalware & Ransomware

ILSpy Domain Compromised - Malware Delivered to Developers

Hackers compromised the ILSpy WordPress domain, redirecting users to a malicious site. Developers are at risk of malware disguised as a browser extension. Stay vigilant and verify downloads!

Cyber Security News·
HIGHMalware & Ransomware

Malware Newsletter Round 91 - Latest Threats and Insights

The latest malware newsletter reveals new threats like Infiniti Stealer and npm supply chain attacks. Developers and organizations must stay alert to evolving risks in cybersecurity.

Security Affairs·
HIGHMalware & Ransomware

Malicious Email Delivers CMD Malware - Privilege Escalation Alert

A malicious email has delivered a .cmd malware file that escalates privileges and bypasses antivirus systems. Users are at risk of significant system compromise. Awareness and immediate action are vital to mitigate this threat.

Security Affairs·
HIGHMalware & Ransomware

Axios NPM Package Compromised - Supply Chain Attack Exposed

A major supply chain attack compromised the Axios NPM package, affecting millions of users. Malicious versions deployed a RAT, posing serious security risks. Swift action was taken to remove the threats.

Trend Micro Research·
HIGHMalware & Ransomware

Brokk Hacked - Play Ransomware Exposes Sensitive Data

Brokk has reportedly been hacked by Play ransomware, leading to the leak of sensitive corporate data. This incident could severely impact the company's reputation and security. Organizations must bolster their defenses to prevent similar breaches.

SC Media·
HIGHMalware & Ransomware

Chaos Malware - New Targeting of 64-bit Linux Servers

Chaos malware has evolved to target 64-bit Linux servers, expanding its attack surface. This shift raises alarms for organizations relying on these systems. Enhanced security measures are now crucial to protect against potential larger-scale attacks.

SC Media·