NODE JS SLACK CLIENT CODE
NODE JS SLACK CLIENT WINDOWS

It is possible that all four packages were authored by the same attacker(s) despite conflicting data provided in the package.jsonВ manifests. Malicious NPMВ package npmpubmanВ exfiltrates environment variables to a remote server It collects user data from the environment variables and uploads this information to a remote host.Д®nvironment information as provided by NodeJS process.envcan reveal sensitive information about a developer'sВ environment such as the PATH variable, database server, ports, API keys, etc.

NODE JS SLACK CLIENT CODE

The last package on the list, npmpubmanВ has a very different code structure and purpose. It is plausible that either the data in package.json was faked by the malware author, or the malware author published these malicious packages using compromised GitHub andВ npm accounts belonging to different developers. The first 3 packages (plutov-slack-client, nodetest1010, and nodetest199) establish a reverse shell to the attacker's serverДЄ key finding is, despite the 3 packages sharing identical code,В the manifest file ( package.json) contained within each of theseВ has drastically different metadata about the whereabouts of the author and their GitHub profiles.

NODE JS SLACK CLIENT WINDOWS

The simplistic code contained within these packages isВ capable of running on both Windows and Unix-based systems.ДЄfter the packages are installed, the codeВ establishes a reverse shell to the attacker's server, allowing the attacker to obtain remote access to the compromised machine. The first three packages plutov-slack-client, nodetest1010, and nodetest199В share identical code.

npmpubmanВ - claims to be 'a simple implementation about Linux shell login' according to the information in the manifestД®stablishes a reverse shell to the attacker's serverДЄlthough the malicious packages were spotted and removed by NPM, I was able to digВ into Sonatype'sВ automated malware detection system archivesВ to obtain copies of their source code, as it had existed on NPM downloads.

plutov-slack-clientВ - claims to be a 'Node.JS Slack Client' according to the information in the manifest.

These 4 packages had collectedВ over 1,000 totalВ downloads over the course of the last few months up until being removed by NPM yesterday. NPM has removed multiple packages hosted on its repository this week that established connection to remote servers and exfiltrated user data.

Node js slack client