Malicious Go and npm Packages Deliver Cross-Platform Malware

The cybersecurity world is on high alert after researchers identified a series of malicious software packages targeting developers. These attacks, discovered in the Go and npm ecosystems, are particularly dangerous because they deliver cross-platform malware capable of affecting both Windows and Linux systems. This new wave of supply chain attacks highlights the ongoing vulnerabilities in open-source software and the sophisticated tactics of threat actors.

Cross-Platform Malware Strikes Go Ecosystem

Security researchers have uncovered a group of 11 malicious Go packages designed to silently download and execute additional payloads. At runtime, the packages spawn a shell to pull a second-stage payload from remote command-and-control (C2) endpoints. This second payload, an obfuscated loader, has functionality to steal host information, access web browser data, and communicate with its C2 server. What makes these packages so effective is their cross-platform capability; they deliver a bash script for Linux systems and retrieve Windows executables, compromising both environments.

The decentralized nature of the Go ecosystem, where modules can be directly imported from GitHub, contributes to the problem. Attackers are exploiting this confusion by crafting malicious module names that appear trustworthy, making it easy for developers to accidentally integrate harmful code into their projects.

npm Packages Impersonate Libraries, Trigger Data Wipes

Meanwhile, the npm registry has been hit with its own set of malicious packages. Two packages, naya-flore and nvlore-hsc, masquerade as legitimate WhatsApp socket libraries. These packages contain a highly destructive kill switch tied to a phone number. If the phone number is not in a specific database, the packages will recursively delete all files on the system using the rm -rf * command.

The packages also contained code to exfiltrate device information, although this functionality was commented out, suggesting it’s an ongoing development. One package even had a hardcoded GitHub Personal Access Token, which could provide unauthorized access to private repositories.

The Growing Threat of Supply Chain Attacks

These incidents are a stark reminder of the escalating risks in the software supply chain. Attackers are increasingly targeting open-source repositories to distribute malware, as compromising a single popular package can affect thousands of downstream projects. The tactics, while not entirely new, are becoming more refined. Threat actors are using obfuscation, minimal file counts, and discreet data exfiltration methods to maximize their impact while staying under the radar. As the use of open-source software continues to grow, so does the attack surface for these types of threats.

Security experts urge developers to exercise extreme vigilance when adding new packages to their projects. This includes carefully vetting packages, enabling two-factor authentication on developer accounts, and using security tools that can detect and prevent supply chain attacks in real-time.