js-logger-pack probe to infostealer to dropper

SafeDep: js-logger-pack spent three weeks on npm evolving from a
probe into a full infostealer and then a binary dropper. Early versions
installed an SSH backdoor.

Mapped techniques

T0109 Publish malicious artifact
T0134 Add user
T0172 Runtime backdoor

supply-chain campaign

T0109 · Resource Development · Publish malicious artifact

Iterated malicious versions.

T0134 · Persistence · Add user

SSH authorized_keys backdoor.

T0172 · Execution · Runtime backdoor

Later binary dropper.

Sources

https://safedep.io/malicious-js-logger-pack-npm-stealer