How To Protect Your Azure Development Environment From These Malicious npm Packages?

JFrog security team has recently identified hundreds of malicious packages which are most likely created to target Azure developers. The report says that precisely there are 217 packages listed in the list of malicious packages aimed to steal PII (Personal Identifiable Information) information such as user names, home directories, IP addresses, and DNS configurations of the victim systems. It is recommended to know how to protect your Azure development environment from these malicious npm packages.

Victims Of Malicious npm Packages:

JFrog team says that after manual inspection of these packages, they found that this was a targeted attack against all npm developers who use packages under @azure, @azure-rest, @azure-tests, @azure-tools, and @cadl-lang scope.

“After manually inspecting some of these packages, it became apparent that this was a targeted attack against the entire @azure npm scope, by an attacker that employed an automatic script to create accounts and upload malicious packages that cover the entirety of that scope.”

How Attackers Delivered Malicious npm Packages?

Attackers used the typosquatting attack method to perform the attack. Under this method, attackers simply create a new (malicious) package with the same name as an existing @azure scope package without the scope name. Moreover, massive downloads of this set of legitimate packages eased the attacker’s task of dropping malicious packages on victim systems. 

In addition to the typosquatting infection method, extremely high version numbers have been used in the malicious packages, indicative of a dependency confusion attack. “A possible conjecture is that the attacker tried to target developers and machines running from internal Microsoft/Azure networks and the typosquatting-based targeting of regular npm users. As mentioned, we did not pursue research on this attack vector and as such this is just a conjecture.”

Example:

@azure/core-tracing is the legitimate package.

core-tracing is the malicious package.

Moreover, attacker might have used an automatic scripts to create multiple user accounts to use them uploading malicious packages to hide the proof of origin.

List Of Identified Malicious npm Packages:

This list consists of a total of 217 malicious npm packages identified so far. Please visit this page for new updates.

How To Protect Your Azure Development Environment From These Malicious npm Packages?

Ensure all the packages installed are legitimate. Check the list of packages that starts with @azure, @azure-rest, @azure-tests, @azure-tools, and @cadl-lang scope. Packages you have installed for Azure development must contain these prefixes.

You can do this by running this command upon changing your current directory to the npm project you would like to test. npm list or npm ls is the command to list the installed packages. Pass this output of the npm list command to grep command to filter the output by the list of packages listed in packages.txt file. You should create a file named packages.txt with all the package names listed in it before you run this command.

npm list | grep -f packages.txt

packagesDownload

It is always good to deploy intelligent supply chain security solutions like JFrog XRAY to prevent such attacks in feature.

We hope this post would help you know How to Protect your Azure Development Environment from these Malicious npm Packages. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, & Medium and subscribe to receive updates like this.