tag: Npm-Supply-Chain · 3 items
- Engineer — Plan: 101 confirmed malicious npm packages are live in the registry; audit your dependency tree against the full package list published by OX Security and remove any matches — the current payload is WhatsApp group enrollment, but the supply-chain foothold could be updated to deliver worse payloads.
- SOC/IR — Learn: PhantomSub is a novel abuse of the Baileys WhatsApp library for subscriber manipulation; no IOCs, SIEM-ready signatures, or ATT&CK mappings are surfaced in the summary, so there is no immediate detection work to do but the technique is worth cataloging.
- Leader — Skip
- Engineer — Act: Supply-chain compromise via npm is directly in scope — audit your package-lock.json and dependency trees for these 13 named packages immediately, remove any matches, and rotate credentials and tokens accessible from affected developer workstations or CI runners.
- SOC/IR — Plan: The overlap with DPRK’s Contagious Interview campaign (BeaverTail TTPs) gives a detection anchor — build or tune rules for suspicious npm package installs on developer endpoints and Chrome extension storage access patterns consistent with credential harvesting.
- Leader — Learn: A DPRK-linked supply-chain operation targeting developer npm environments is worth adding to the developer-risk section of the risk register, but no systemic or vendor-level exposure is confirmed yet — monitor for follow-on reporting.
- Engineer — Act: Two named malicious packages — ‘bianira-ui’ and ‘fluid-type-ui’ — are trojanized with active C2 capability; audit all dependency trees and lock files for these packages and remove them immediately if found.
- SOC/IR — Plan: NullReceiver is a novel dead-drop resolver technique that hides C2 IPs inside empty Ethereum transfer destinations, making traditional blocklist-based detections ineffective; build or tune detections for unusual outbound Ethereum RPC calls originating from build pipelines or developer endpoints this quarter.
- Leader — Learn: Attackers are using blockchain infrastructure to evade C2 detection in software supply-chain attacks — a technique evolution worth including in risk-posture discussions, but no immediate leadership action is required given the limited scope and absence of a major corroborated campaign.