Sifting through crates.io for malware with OSSF Package Analysis

I have a particular fascination with the threat of supply chain compromise via package manager operations. Not so much that a malicious library will be embedded into the final product; rather, that when the programmer installs a package, such as from NPM, PyPI, or crates.io, arbitrary code is executed, which may deposit a backdoor that grants access to the developer’s access, secrets, etc.

Again, as developers, we should remember that simply installing a source code package from a repository can invoke arbitrary code on your system.

One way to monitor for these sorts of attacks is to do large scale installations of all available packages and see what behavior we encounter. This is one thing that the Open Source Security Foundation (OpenSSF) does.

The OSSF Package Analysis project:

seeks to understand the behavior and capabilities of packages available on open source repositories: what files do they access, what addresses do they connect to, and what commands do they run? The project also tracks changes in how packages behave over time, to identify when previously safe software begins acting suspiciously.

They do this by:

1. Package repositories are monitored for new packages.
2. Each new package is scheduled to be analyzed by a pool of workers.
3. A worker performs dynamic analysis of the package inside a sandbox.
4. Results are stored and imported into BigQuery for inspection.

Sandboxing via gVisor containers ensures the packages are isolated. Detonating a package inside the sandbox allows us to capture strace and packet data that can indicate malicious interactions with the system as well as network connections that can be used to leak sensitive data or allow remote access.

Notably, the project exposes their BigQuery data set here.

The data set currently includes packages from:

• npm
• pypi
• rubygems
• packagist
• crates.io

I started exploring crates.io packages first, since I follow the Rust ecosystem and am familiar with the crates.io infrastructure. In my experience, NPM has many more packages and also quite a bit of malware. This can be overwhelming. I think crates.io has enough data to get started while not being exhausting.

Sifting through crates.io packages

I inspected the dynamic analysis results captured by OSSF Package Analysis as they installed and built Rust packages from crates.io. I expect all of the interesting activity will come from build.rs scripts that can do arbitrary things at compile time.

My general strategy is to aggregate activity and estimate the prevalence of various techniques, and then look in the “long tail” of uncommon behavior. For example, by reviewing the DNS names resolved during package installation, and filtering out the domains related to crates.io, I can discover when curl (or similar) is used to fetch untrusted remote content.

DNS resolutions during crates.io package installation

crates.io package name, version, and DNS resolutions during installation. Just to get a sense for the data, so selected from a recent day and limited to 100.

SELECT 
  T.Package,
  Queries.Hostname
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.DNS as DNS,
  DNS.Queries as Queries
WHERE
  TIMESTAMP_TRUNC(CreatedTimestamp, DAY) = TIMESTAMP("2023-09-12")
  AND Package.Ecosystem = "crates.io"
;

Prevalence of DNS resolutions during crates.io package installation

SELECT 
  Queries.Hostname, 
  COUNT(*) AS `count`
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.DNS as DNS,
  DNS.Queries AS Queries
WHERE
  TIMESTAMP_TRUNC(CreatedTimestamp, YEAR) = TIMESTAMP("2023-01-01")
  AND Package.Ecosystem = "crates.io"
GROUP BY Queries.Hostname
ORDER BY `count` DESC
;

At least two entries stand out as suspicious:

• ip-api.com: “whats my IP?” to be included in a reconaissance report?
• api.telegram.org: command and control via Telegram?

static.crates.iocrates seems a little weird, but is quickly explained by a bug in crates.io in this incident report: crates.io Postmortem: Broken Crate Downloads.

Uncommon DNS names resolved during crates.io package installation

We can generate the direct download URL for the crate given the name and version. The content is a gzip-compressed tar archive containing the Rust source code and Cargo.toml metadata file.

SELECT
  Queries.Hostname,
  T.Package.Name,
  T.Package.Version,
  FORMAT(
    "https://crates.io/api/v1/crates/%s/%s/download",
    T.Package.Name,
    T.Package.Version) AS url
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.DNS as DNS,
  DNS.Queries AS Queries
WHERE
  Package.Ecosystem = "crates.io"
  AND Queries.Hostname NOT IN (
    "github.com", "crates.io", "static.crates.io",
    "api.github.com", "static.crates.iocrates")
ORDER BY 
  Queries.Hostname, 
  T.Package.Name, 
  T.Package.Version 
  DESC
;

So we can see that api.telegram.org was resolved by xrvrv@0.1.1, which was nicely described by Phylum here: Rust Malware Staged on Crates.io.

I triaged the remaining uncommon DNS resolutions and didn’t find anything malicious.

Commands executed during crates.io package installation

SELECT
  T.Package.Name,
  T.Package.Version,
  ARRAY_TO_STRING(Commands.Command, " ") AS command
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.Commands as Commands
WHERE
  Package.Ecosystem = "crates.io"
  AND TIMESTAMP_TRUNC(CreatedTimestamp, MONTH) = TIMESTAMP("2023-09-01")
ORDER BY 
  T.Package.Name, 
  T.Package.Version 
  ASC
LIMIT 10
;

…which is kind of noisy and difficult to scan. So, let’s focus just on the executable, not complete command line.

Prevalence of programs executed during crates.io package installation

SELECT
  Commands.Command[offset(0)] AS exe,
  COUNT(*) AS `count`,
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.Commands as Commands
WHERE
  Package.Ecosystem = "crates.io"
  AND TIMESTAMP_TRUNC(CreatedTimestamp, MONTH) = TIMESTAMP("2023-09-01")
  AND Commands.Command[offset(0)] NOT LIKE "/app/target/%"
GROUP BY exe
ORDER BY `count` DESC
;

I wonder why some packages use curl during installation? Let’s see which packages those are.

crates.io packages invoking a specific program during installation

SELECT
  T.Package.Name,
  T.Package.Version,
  ARRAY_TO_STRING(Commands.Command, " ") AS command,
  Commands.Command[OFFSET(0)] AS exe,
  FORMAT(
    "https://crates.io/api/v1/crates/%s/%s/download", 
    T.Package.Name, 
    T.Package.Version) AS url
FROM
  `ossf-malware-analysis.packages.analysis` AS T,
  T.Analysis.install.Commands AS Commands
WHERE
  Package.Ecosystem = "crates.io"
  AND TIMESTAMP_TRUNC(CreatedTimestamp, YEAR) = TIMESTAMP("2023-01-01")
  AND Commands.Command[OFFSET(0)] = "curl"
ORDER BY
  T.Package.Name,
  T.Package.Version 
  ASC
;

Continuing work

Of course, you can apply all the above queries to the other package registries, such as NPM and Rubygems. Expect to see more data in every dimension, including ongoing attacks & malware.

I’ll keep this post updated as I craft further useful queries for exploring the OSSF Package Analysis data set. I’m keen to periodically run queries that highlight “new” activity, such as DNS names that haven’t been seen before. Perhaps I can find a way to publish that feed via RSS and encourage everyone to monitor new packages.