NPM malware hunt with OSSF Package Analysis, Sept 21, 2023

SELECT
  Commands.Command[offset(0)] AS exe,
  COUNT(*) AS `count`,
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.Commands as Commands
WHERE
  Package.Ecosystem = "npm"
  AND TIMESTAMP_TRUNC(CreatedTimestamp, MONTH) = TIMESTAMP("2023-09-01")
GROUP BY exe
ORDER BY `count` DESC
;

SELECT
  T.Package.Name,
  T.Package.Version,
  Commands.Command[OFFSET(0)] AS exe,
  ARRAY_TO_STRING(Commands.Command, " ") AS command
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.Commands AS Commands
WHERE
  Package.Ecosystem = "npm"
  AND TIMESTAMP_TRUNC(CreatedTimestamp, MONTH) = TIMESTAMP("2023-09-01")
  AND Commands.Command[OFFSET(0)] IN ("curl", "whoami", "/usr/bin/curl", "python", "wget", "docker", "sudo", "/bin/echo", "ping", "nc")
ORDER BY
  T.Package.Name,
  T.Package.Version 
  ASC
;

SELECT
  Files
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.Files as Files
WHERE
  Package.Ecosystem = "npm"
  AND TIMESTAMP_TRUNC(CreatedTimestamp, MONTH) = TIMESTAMP("2023-09-01")
  AND Package.Name = "puppeteer-example"
  AND Package.Version = "0.1.5"
  AND Files.Read = true
;

SELECT
  T.Package.Name,
  T.Package.Version,
  Files
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.Files as Files
WHERE
  Package.Ecosystem = "npm"
  AND TIMESTAMP_TRUNC(CreatedTimestamp, MONTH) = TIMESTAMP("2023-09-01")
  AND Files.Write = true
  AND Files.Path NOT LIKE "/app/%"
  AND Files.Path NOT LIKE "/root/.npm/%"
  AND Files.Path NOT LIKE "/root/.cache/%"
  AND Files.Path NOT LIKE "/root/.node-gyp/%"
  AND Files.Path NOT LIKE "/tmp/%"
  AND Files.Path NOT LIKE "/usr/local/cargo/%"
  AND Files.Path NOT LIKE "/usr/lib/node_modules/%"
  AND Files.Path NOT LIKE "host:%"
  AND Files.Path NOT LIKE "pipe:%"
  AND Files.Path NOT LIKE "socket:%"
  AND Files.Path NOT LIKE "anon_inode:%"
  AND Files.Path != "/dev/tty"
  AND Files.Path != "/dev/null"
  LIMIT 1000
;