Poisoned Pipeline / Incidents / AS64
electron-native-notify planted in Agama / Komodo wallet
In March 2019 the npm security team, with Komodo, stopped a plot to
steal Agama wallet seeds. GitHub user sawlysawly added
electron-native-notify ^1.1.5 to KomodoPlatform/EasyDEX-GUI on 8 March.
Version 1.1.6 (23 March) was the first with a malicious payload; Agama
v0.3.5 shipped it on 13 April. After launch the wallet fetched a second
stage from updatecheck.herokuapp and exfiltrated the seed. Classic
“useful package, wait until adopted, then flip the next version.”
npm removed the package and wired npm audit.
Mapped techniques
- T0109 Publish malicious artifact
- T0111 Malicious code contribution to an open-source repository
- T0121 Compromised legitimate artifact
- T0184 Harvesting sensitive information from files
- T0156 Exfiltration over webhooks
supply-chain delayed malicious update
electron-native-notify published as a useful helper, then flipped.
Dependency added to KomodoPlatform/EasyDEX-GUI.
Later versions of an already-adopted package carried the payload.
Agama wallet seed and login passphrases.
Second stage from updatecheck.herokuapp received the seed.