B
ä»é±äž
npmã¬ãžã¹ããªã«ãWindowsãMacãLinuxãæšçãšããçŽ800åã®æªæããããã±ãŒãž
ð äžèšã§ãããš
npmã¬ãžã¹ããªã«ãWindowsãMacãLinuxãæšçãšããçŽ800åã®æªæããããã±ãŒãžãå
¬éãããŸããããããã®ããã±ãŒãžã¯AIãçšããŠçæãããã¿ã€ãã¹ã¯ã¯ããã£ã³ã°åã䜿çšããŠãããREADMEã®æç€ºã«åŸãrequire()ã§èªã¿èŸŒãããšã§ãRATããã³æ
å ±çªåããŒã«ãé
åžããŸããããŠã³ããŒããŒãWEL1DROPPERããä»ããŠãCloudflare WorkersããOSã«é©åãããã€ããŒããååŸãããä»çµã¿ã§ãã
ð該åœå€å®
- JavaScriptãTypeScriptãçšããã·ã¹ãã éçºãèªç€ŸãŸãã¯å€æ³šå ã§è¡ã£ãŠãã
- ããã±ãŒãžç®¡çããŒã«ã§ãããnpmããå©çšããŠã©ã€ãã©ãªãå°å ¥ããŠãã
- éçºè ãnpmããæ°ããã©ã€ãã©ãªãã€ã³ã¹ããŒã«ããã³ãŒãå ã§ãrequire()ããçšããŠèªã¿èŸŒãã§ãã
äžèšãããã«ã該åœããªã â é芳ã§OK
â
è©²åœæã®å¯Ÿå¿
ä¿¡é Œã§ããªãnpmããã±ãŒãžã®ã€ã³ã¹ããŒã«ãé¿ããããã±ãŒãžåã®æ£ç¢ºæ§ã確èªããããšããŸããéçºç°å¢ã«ãããäžå¯©ãªã¢ãŠãããŠã³ãéä¿¡ïŒç¹ã«Cloudflare Workersçãžã®éä¿¡ïŒãç£èŠããããšãæšå¥šããŸãã
ð§ ã¡ãŒã«æ¡ãèŠã (管çè åã)
â ïž ãã㯠AI ãçæããåèäŸã§ããé
ä¿¡åã«å¿
ãå
容ãã確èªã®ããã貎瀟ã®ç¶æ³ã«åãããŠç·šéããŠãå©çšãã ãããå®éã®è¢«å®³ç¶æ³ãèªç€Ÿã®å©çšç°å¢ãèžãŸãã倿ã¯ã貎瀟ã®ã»ãã¥ãªãã£è²¬ä»»è
ã«ã確èªãã ããã
ä»¶å: ãå
±æãnpmã«ãããæªæããããã±ãŒãžïŒRAT/InfostealerïŒã®é
åžã«ã€ããŠ
ãç²ãããŸã§ããnpmã¬ãžã¹ããªã«ããããµãã©ã€ãã§ãŒã³æ»æã«é¢ããæ å ±å ±æã§ãã
â æŠèŠ
AIãçšããŠçæãããã¿ã€ãã¹ã¯ã¯ããã£ã³ã°åã®æªæããnpmããã±ãŒãžïŒçŽ800åïŒã確èªãããŸãããREADMEã®æç€ºã«åŸãrequire()ã§èªã¿èŸŒãããšã§ãããŠã³ããŒããŒãWEL1DROPPERããåäœããæçµçã«ã¯ãã¹ãã©ãããã©ãŒã 察å¿ã®RATããã³æ å ±çªåããŒã«ãã€ã³ã¹ããŒã«ãããŸãã
â 圱é¿ç¯å²
- npmããã±ãŒãžãå©çšããŠéçºãè¡ãå šOSïŒWindows, Mac, LinuxïŒç°å¢
â å¯Ÿå¿æé
1. éçºããŒã ã«å¯Ÿããäžå¯©ãªããã±ãŒãžã®ã€ã³ã¹ããŒã«çŠæ¢ãšãããã±ãŒãžåã®å確èªã培åºãããã
2. ãããã¯ãŒã¯ãã°ã確èªããäžå¯©ãªCloudflare Workersãã¡ã€ã³ïŒoob-worker.cf1çïŒãžã®éä¿¡ãçºçããŠããªãã調æ»ããã
3. äŸåé¢ä¿ç®¡çããŒã«ïŒnpm auditçïŒãçšããŠãæ¢ç¥ã®æªæããããã±ãŒãžãå«ãŸããŠããªããã¹ãã£ã³ã宿œããã
â åèæ å ±
- OpenSourceMalware ç ç©¶å ±å
察å¿åªå 床: é«
å¯Ÿå¿æé: æ¬æ¥äž
ãç²ãããŸã§ããnpmã¬ãžã¹ããªã«ããããµãã©ã€ãã§ãŒã³æ»æã«é¢ããæ å ±å ±æã§ãã
â æŠèŠ
AIãçšããŠçæãããã¿ã€ãã¹ã¯ã¯ããã£ã³ã°åã®æªæããnpmããã±ãŒãžïŒçŽ800åïŒã確èªãããŸãããREADMEã®æç€ºã«åŸãrequire()ã§èªã¿èŸŒãããšã§ãããŠã³ããŒããŒãWEL1DROPPERããåäœããæçµçã«ã¯ãã¹ãã©ãããã©ãŒã 察å¿ã®RATããã³æ å ±çªåããŒã«ãã€ã³ã¹ããŒã«ãããŸãã
â 圱é¿ç¯å²
- npmããã±ãŒãžãå©çšããŠéçºãè¡ãå šOSïŒWindows, Mac, LinuxïŒç°å¢
â å¯Ÿå¿æé
1. éçºããŒã ã«å¯Ÿããäžå¯©ãªããã±ãŒãžã®ã€ã³ã¹ããŒã«çŠæ¢ãšãããã±ãŒãžåã®å確èªã培åºãããã
2. ãããã¯ãŒã¯ãã°ã確èªããäžå¯©ãªCloudflare Workersãã¡ã€ã³ïŒoob-worker.cf1çïŒãžã®éä¿¡ãçºçããŠããªãã調æ»ããã
3. äŸåé¢ä¿ç®¡çããŒã«ïŒnpm auditçïŒãçšããŠãæ¢ç¥ã®æªæããããã±ãŒãžãå«ãŸããŠããªããã¹ãã£ã³ã宿œããã
â åèæ å ±
- OpenSourceMalware ç ç©¶å ±å
察å¿åªå 床: é«
å¯Ÿå¿æé: æ¬æ¥äž
Subject: [Alert] Malicious npm Packages Delivering Cross-Platform RAT/Infostealer
Dear IT/Security Team,
We are sharing information regarding a supply chain attack targeting the npm registry.
â Overview
Approximately 800 malicious npm packages using AI-generated typo-squatting names have been identified. These packages trick developers into using the require() function to execute a downloader named WEL1DROPPER, which subsequently fetches a cross-platform RAT and infostealer from Cloudflare Workers hosts.
â Scope
- All development environments (Windows, Mac, Linux) utilizing npm packages.
â Action Plan
1. Instruct development teams to verify package names strictly and avoid installing untrusted packages.
2. Monitor network logs for suspicious outbound traffic to Cloudflare Workers domains (e.g., oob-worker.cf1).
3. Perform dependency scans using tools like 'npm audit' to identify any compromised packages in existing projects.
â Reference
- OpenSourceMalware Research
Priority: High
Deadline: Immediate
Dear IT/Security Team,
We are sharing information regarding a supply chain attack targeting the npm registry.
â Overview
Approximately 800 malicious npm packages using AI-generated typo-squatting names have been identified. These packages trick developers into using the require() function to execute a downloader named WEL1DROPPER, which subsequently fetches a cross-platform RAT and infostealer from Cloudflare Workers hosts.
â Scope
- All development environments (Windows, Mac, Linux) utilizing npm packages.
â Action Plan
1. Instruct development teams to verify package names strictly and avoid installing untrusted packages.
2. Monitor network logs for suspicious outbound traffic to Cloudflare Workers domains (e.g., oob-worker.cf1).
3. Perform dependency scans using tools like 'npm audit' to identify any compromised packages in existing projects.
â Reference
- OpenSourceMalware Research
Priority: High
Deadline: Immediate