How To Protect Your NPM From The IconBurst Campaign

Security researchers from ReversingLabs published about a campaign named ‘IconBurst’. The campaign is a supply chain attack carried out to install malicious NPM modules to steal user data from the compromised desktop, mobile, and web applications. More than a couple of dozens of malicious modules were identified that took part in the IconBurst campaign. It’s been suspected that these malicious modules have been downloaded more than 27K times collectively. There is no data available that tells about the usage of these NPM packages in applications and websites. The number could be a hundred or thousand. Additionally, no estimations were made about the amounts of user data stolen. We suggest you scan your NPM development environment for these malicious NPM modules and take action to protect your NPM from the IconBurst Campaign.

Victims Of Malicious npm Packages:

ReversingLabs says that there are no signs of a clear target as of the day published this post. However, investigations are still in progress; new developments will be shared, if any.

Karlo Zanki, Reverse Engineer at ReversingLabs, says, “While the full extent of this attack isn’t yet known, the malicious packages we discovered are likely used by hundreds, if not thousands of downstream mobile and desktop applications as well as websites.”

How Attackers Delivered Malicious NPM Packages In the IconBurst Campaign?

Attackers used the typosquatting attack method in this campaign. In this method of typosquatting, attackers simply create a new (malicious) package with a name that resembles the legitimate package name and publish them in public repositories. Attackers use this technique to fool the users who try to download the package from the public repositories. Anyways, such a massive amount of downloads of legitimate packages will ease the task of attackers to confuse the user to download malicious packages on victim systems. 

In addition to the typosquatting infection method, attackers were also seen using dependency confusion attacks in that attackers publish the malicious packages with extremely high version numbers that give a feel of the latest package.

How To Protect Your NPM From The IconBurst Campaign?

Ensure all the packages installed are legitimate. We suggest you scan your NPM development environment for the modules listed in the below section and take action to protect your NPM from the IconBurst Campaign.

A simple Way To Scan The NPM Development Environment For Malicious Modules:

npm list | grep -f examplenpmpackages.txt

npm list or npm ls is the command to list the installed packages. Pass the output of the npm list command to the grep command to filter the output by the list of packages listed in the examplenpmpackages.txt file.

It is always good to deploy intelligent supply chain security solutions like JFrog XRAY to prevent such attacks in feature. 

List Of Malicious NPM Packages Seen In IconBurst Campaign:

This table consists of a total of 31 malicious NPM packages with version numbers identified so far. Please visit this page for new updates.

Upon further investigation, the research team said they had identified some common connections with a few user accounts like ionic-io; arpanrizki; kbrstore; and aselole and domains.

List Of malicious NPM modules With Associated Author Names And Downloaded Count:

IoCs Of IconBurst Campaign:

We hope this post would help you know How to Protect Your NPM from the IconBurst Campaign. Please share this post and help to secure the digital world. Visit our social media page on Facebook, LinkedIn, Twitter, Telegram, Tumblr, Medium & Instagram, and subscribe to receive updates like this.