By 
Cybersecurity researchers have uncovered malicious packages in the npm and PyPI repositories designed to steal sensitive information and even delete files from infected systems. These packages exploit developers and users, targeting Solana wallets, Discord APIs, and more.
Identified Malicious Packages
The malicious packages include the following:
npm:
- @async-mutex/mutex (typosquatting async-mute)
- dexscreener (posing as a library for accessing DEX liquidity pool data)
- solana-transaction-toolkit
- solana-stable-web-huks
- cschokidar-next (typosquatting chokidar)
- achokidar-next (typosquatting chokidar)
- achalk-next (typosquatting chalk)
- csbchalk-next (typosquatting chalk)
- cschalk (typosquatting chalk)
PyPI:
- pycord-self (typosquatting discord.py-self)
Stealing Solana Wallet Keys
Security firm Socket, which discovered the packages, reported that the first four npm packages target Solana wallets. They intercept private keys and exfiltrate them via Gmail’s Simple Mail Transfer Protocol (SMTP). By using Gmail's trusted servers, the malware bypasses firewalls and detection systems, making these attacks harder to identify.
The packages solana-transaction-toolkit and solana-stable-web-huks go further by programmatically draining wallets. These packages automatically transfer up to 98% of the wallet’s contents to attacker-controlled Solana addresses while masquerading as legitimate tools for Solana-related development.
GitHub Repository Abuse
Threat actors also used GitHub repositories to spread the malicious packages. Repositories such as "moonshot-wif-hwan" and "Diveinprogramming" claimed to provide Solana tools but instead imported malicious code. Although these accounts have been removed, the repositories hosted scripts that further propagated the malware.
For example, a script from the repository moonshot-wif-hwan/pumpfun-bump-script-bot claimed to automate trading on Raydium, a Solana-based decentralized exchange, but instead executed harmful code from the solana-stable-web-huks package.
Destructive “Kill Switch” Functionality
The second set of npm packages, including csbchalk-next, featured a destructive "kill switch" that recursively deleted files in project-specific directories. This functionality was triggered when the server sent a "202" response code. Additionally, some packages exfiltrated environment variables to remote servers.
Targeting Python Developers
The PyPI package pycord-self targeted Python developers integrating Discord APIs into their projects. It captured Discord authentication tokens and connected to an attacker-controlled server, enabling persistent backdoor access on infected Windows and Linux systems.
Broader Trends in Malware Campaigns
These findings align with other recent attacks targeting developers and users. For instance, Roblox players have been targeted with malicious PyPI libraries distributing open-source stealer malware like Skuld and Blank-Grabber. Developers looking for cheats and mods have inadvertently downloaded similar payloads.
Recommendations
To mitigate such risks, developers and organizations should:
- Verify the authenticity of packages before installation.
- Use tools like dependency scanners to detect malicious dependencies.
- Monitor and update project dependencies regularly.
- Report suspicious packages to repository maintainers.
This campaign underscores the growing sophistication of supply chain attacks, emphasizing the need for vigilance among developers and cybersecurity professionals alike.
Image Credit : CNBC
