NPM malware hunt with OSSF Package Analysis, Sept 20, 2023

Following up on Sifting through Crates.io for Malware, I started poking around the packages submitted to NPM during September 1-20, 2023. There is so much obvious malware and “security testing”.

The more interesting malware is probably the stuff that isn’t so obvious. Still, this exercise lets us practice our skills and tune our tools.

In this post we’ll start with DNS resolutions made during package installation:

SELECT 
  Queries.Hostname, 
  COUNT(*) AS `count`
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.DNS as DNS,
  DNS.Queries AS Queries
WHERE
  TIMESTAMP_TRUNC(CreatedTimestamp, MONTH) = TIMESTAMP("2023-09-01")
  AND Package.Ecosystem = "npm"
GROUP BY Queries.Hostname
ORDER BY `count` DESC
;

Immediately suspicious domains related to security testing and/or reverse shells:

• *.canarytokens.com
• *.burpcollaborator.net
• *.oast.fun
• *.oastify.fun
• *.pipedream.net
• *.ngrok-free.app

SELECT
  Queries.Hostname,
  T.Package.Name,
  T.Package.Version,
  FORMAT(
    "https://registry.npmjs.org/%s/%s",
    T.Package.Name,
    T.Package.Version) AS url
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.DNS as DNS,
  DNS.Queries AS Queries
WHERE
  Package.Ecosystem = "npm"
  AND TIMESTAMP_TRUNC(CreatedTimestamp, MONTH) = TIMESTAMP("2023-09-01")
  AND (
    Queries.Hostname LIKE "%.canarytokens.com"
    OR Queries.Hostname LIKE "%.burpcollaborator.net"
    OR Queries.Hostname LIKE "%.oast.fun"
    OR Queries.Hostname LIKE "%.oastify.fun"
    OR Queries.Hostname LIKE "%.pipedream.net"
    OR Queries.Hostname LIKE "%.ngrok-free.app"
  )
ORDER BY 
  T.Package.Name, 
  T.Package.Version,
  Queries.Hostname
  DESC
;

IP checking domains:

• ifconfig.me
• ipinfo.io
• api64.ipify.org
• api.ipify.org
• api.ifdns.top

CDN domains, which could go either way:

• ds5wd4w77e8d7.cloudfront.net
• shift72-sites.s3.amazonaws.com
• d2xmf7eesbz9z9.cloudfront.net
• drwpxdi3xxat9.cloudfront.net
• d7mr6puf9ww39.cloudfront.net
• d366veejw7r0h.cloudfront.net

Generally suspicious domains:

• static.snyk.io
• www.uuidgenerator.net
• app.threatest.com
• webhook.site
• service.tunnelmole.com
• clndly.bookingflix.com
• calbold.bookingflix.com
• js.rip
• dist.ipfs.tech
• static.pharmacyyf.com
• newtesttocheckscanner.package.0xlupin.com
• hooks-testnet-v3.xrpl-labs.com

Further Ideas:

• join with current NPM package state to see what is already yanked
  • e.g. "version":"0.0.1-security","description":"security holding package","repository":"npm/security-holder"
• pivot from package to author to other packages
• find packages that depend on a malicious package