Poisoned Pipeline / Incidents / AS187
Named npm malware families (Skeleton Squad, Skuld, Quasar, FezBox, Koishi)
Socket named-family posts: Skeleton Squad, Skuld infostealer returning
to npm, Quasar RAT as an npm package, FezBox QR-code cookie stealer,
Koishi chatbot plugin, Akiraa-WB file exfil, Advcash reverse shell,
ReExt git-credential theft, npm bin-script confusion, 10 typosquat
harvesters, 60 packages leaking host/network data, chalk/chokidar
typosquat payloads, wrapper packages, author-typosquatting, mimicking
familiar library names, Adspect cloaking redirects.
Mapped techniques
- T0109 Publish malicious artifact
- T0129 Typosquatting
- T0172 Runtime backdoor
- T0184 Harvesting sensitive information from files
supply-chain campaign
Named families plus typosquat waves.
Library-name mimics.
Quasar/Skuld/FezBox.
Cookies, git creds, host data.
Sources
- https://socket.dev/blog/skeleton-squad-npm
- https://socket.dev/blog/skuld-infostealer-returns-to-npm
- https://socket.dev/blog/quasar-rat-disguised-as-an-npm-package
- https://socket.dev/blog/malicious-fezbox-npm-package-steals-browser-passwords-from-cookies-via-innovative-qr-code
- https://socket.dev/blog/malicious-koishi-chatbot-plugin
- https://socket.dev/blog/malicious-akiraa-wb-npm-package-exfiltrates-files-to-external-services
- https://socket.dev/blog/npm-package-advcash-integration-triggers-reverse-shell
- https://socket.dev/blog/npm-package-for-reext-react-components-library-exfiltrates-git-credentials
- https://socket.dev/blog/npm-bin-script-confusion
- https://socket.dev/blog/10-npm-typosquatted-packages-deploy-credential-harvester
- https://socket.dev/blog/60-malicious-npm-packages-leak-network-and-host-data
- https://socket.dev/blog/kill-switch-hidden-in-npm-packages-typo-squatting-chalk-and-chokidar
- https://socket.dev/blog/malicious-wrapper-packages-on-npm
- https://socket.dev/blog/author-typosquatting-on-npm
- https://socket.dev/blog/npm-targeted-by-malware-campaign-mimicking-familiar-library-names
- https://socket.dev/blog/malicious-npm-packages-inject-ssh-backdoors-via-typosquatted-libraries
- https://socket.dev/blog/malicious-npm-package-typosquats-popular-typescript-eslint-plugin
- https://socket.dev/blog/malicious-npm-package-typosquats-react-login-page-to-deploy-keylogger
- https://socket.dev/blog/malicious-npm-packages-target-react-vue-and-vite-ecosystems-with-destructive-payloads
- https://socket.dev/blog/npm-malware-campaign-uses-adspect-cloaking-to-deliver-malicious-redirects