Disclosures
Disclosures: npm malware reports and research
Long-form reports on malicious npm packages Protet analysed. Each one states what was observed, what was recovered from the package, and what could not be determined. For every package Protet has confirmed, including those without a full report, see Protet Intel.
Reports
-
totp-utils npm malware: Discord and Minecraft theft
Published as a TOTP helper with a working TOTP implementation as cover. On install and on use it harvests Discord tokens and Minecraft accounts and uploads them to a Discord webhook; its latest version drops a Fabric mod that steals browser cookies and passwords. Still live on the registry.
-
app-soda-layer npm backdoor: secret theft, SSH key
Recovered in full from a sandbox trace after the package was removed from the registry. Reads wallet keys and application secrets and uploads their contents; requests an SSH public key from a remote host and appends it to ~/.ssh/authorized_keys.
Research
Technique write-ups: how something was done, rather than what one package did.
-
Recover a deleted npm package from a syscall trace
A package we detonated was deleted from the registry two hours after it was published. We still had the source, because of how npm installs things.