CP
cyberpings
Malware & RansomwareHIGH

Malware - Five Malicious npm Packages Target Crypto Developers

CSCyber Security News
npmcryptoTelegrammalicious packagesSolana
🎯

Basically, some bad software pretends to be useful and steals your crypto keys.

Quick Summary

Five malicious npm packages have been found targeting crypto developers, stealing private wallet keys and sending them to a Telegram bot. This poses a significant supply chain threat to the crypto community. Developers are urged to take immediate action to secure their wallets and keys.

What Happened

The cryptocurrency development community is facing a serious threat. Five malicious npm packages were discovered that steal private wallet keys from developers. These packages were published under the npm account "galedonovan" and were designed to look like trusted libraries used by Solana and Ethereum developers. Once installed, they operate silently, capturing sensitive key material and sending it directly to a Telegram bot.

The malicious packages include raydium-bs58, base-x-64, bs58-basic, and base_xd, which target Solana developers. They intercept Base58 decode() calls, a common method for loading a keypair from a private key string. The fifth package, ethersproject-wallet, hooks into the Ethereum Wallet constructor to capture private keys as they are passed in. This means that as soon as a developer uses these packages, their keys are sent out as plain text, allowing attackers to drain their wallets.

Who's Being Targeted

These malicious packages primarily target developers within the Solana and Ethereum ecosystems. By masquerading as legitimate libraries, they exploit the trust developers place in npm packages. The attack is particularly insidious because it affects both major blockchain platforms simultaneously, putting a wide range of developers at risk. Developers who unknowingly install these packages may not realize their keys have been compromised until it’s too late.

Socket.dev researchers identified these packages as part of a coordinated typosquatting campaign. Each package was linked to the same npm account and used a hardcoded Telegram bot endpoint for exfiltration. The bot, @Test20131_Bot, is managed by a user identified as @crypto_sol3, further indicating a targeted approach to stealing cryptocurrency.

Signs of Infection

The key theft occurs through a technique called function hooking. This means that the attacker wraps a function that developers commonly use to handle private keys. When a key is passed through, it is intercepted and sent to a Telegram bot before the legitimate function completes. This allows the attack to go unnoticed, as everything appears to work normally.

For instance, in the raydium-bs58 package, the modified decode() function sends the key to the bot before executing the actual decode. Similarly, the base-x-64 package obscures its malicious intent by using an array rotation cipher to scramble its Telegram URL and bot token. Developers may not see any errors, leading them to believe they are using a legitimate package while their keys are compromised.

How to Protect Yourself

If you have installed any of these malicious packages, treat every private key that passed through them as compromised. Immediately move your funds and rotate your keys to prevent unauthorized access. The legitimate replacements for these packages are bs58, base-x, and the scoped @ethersproject/wallet from the official ethers.js monorepo.

Additionally, be vigilant about auditing transitive dependencies. The package bs58-basic, for example, quietly pulls in base-x-64 as its only runtime dependency, making it crucial to inspect all dependencies thoroughly. Moving forward, any npm package that re-exports cryptographic utilities or contains obfuscated code near key-handling logic should be treated with suspicion until proven safe.

🔒 Pro insight: This incident highlights the growing risk of supply chain attacks in the npm ecosystem, particularly targeting cryptocurrency developers.

Original article from

Cyber Security News · Tushar Subhra Dutta

Read Full Article

Share

Related Pings

HIGHMalware & Ransomware

Malware - Russian Hacker Sentenced for Ransomware Attacks

A Russian hacker has been sentenced to two years for managing a botnet that launched ransomware attacks on U.S. companies. This case highlights the ongoing threat of cybercrime and the significant financial impact on businesses. As cybercriminals grow more sophisticated, organizations must bolster their defenses against such attacks.

The Hacker News·
HIGHMalware & Ransomware

Ransomware - Russian Broker Sentenced for Cybercrime Role

Aleksei Volkov, an Initial Access Broker, was sentenced to prison for enabling ransomware attacks on U.S. companies. His actions led to over $9 million in damages. This case highlights the ongoing threat of cybercrime and the importance of international law enforcement collaboration.

Cyber Security News·
HIGHMalware & Ransomware

Malware - PyPI Warns of LiteLLM Credential Theft

PyPI has warned developers about LiteLLM malware that steals cloud and CI/CD credentials. This incident could have widespread implications for users. Immediate action is necessary to secure sensitive information.

CSO Online·
HIGHMalware & Ransomware

Malware - US Prisons Russian Access Broker for Ransomware

Aleksei Volkov has been sentenced for his role in ransomware attacks, causing over $9 million in losses. This case highlights the ongoing threat of ransomware. Organizations must strengthen their defenses against such cyber threats.

SecurityWeek·
HIGHMalware & Ransomware

Malware - Manager of Botnet Sentenced for Ransomware Attacks

A Russian man was sentenced for managing a botnet behind ransomware attacks on U.S. companies. This operation led to over $14 million in extortion payments. It's a stark reminder of the ongoing cyber threats businesses face.

BleepingComputer·
HIGHMalware & Ransomware

LiteLLM Compromised - TeamPCP Hackers Inject Backdoor

The LiteLLM Python package has been compromised by hackers, affecting millions of users. This breach allows attackers to steal sensitive data and gain unauthorized access. Immediate audits and credential rotations are crucial for affected organizations.

Cyber Security News·