The Lazarus Group has shifted from traditional typosquatting to "brandjacking" within the npm ecosystem, deploying multi-stage droppers disguised as utilities for popular libraries like React, Buffer, and Chai. These malicious packages execute Base64-encoded strings to fetch a second-stage Node.js backdoor from jsonkeeper.com, which subsequently connects to a C2 server (45.59.163.198:1244) to deploy a final payload (f.js) into the ~/.vscode directory. By utilizing npm install --silent for dependency resolution, the attackers establish persistent remote code execution (RCE) on developer workstations, posing a critical risk to CI/CD pipelines and source code repositories.

• Incident Overview: Brandjacking Evolution

  • Transition from simple misspellings to "brandjacking," where packages mimic legitimate utilities or version updates for established libraries.
  • Attackers integrate functional, legitimate code into malicious packages to evade immediate detection by developers and basic security scanners.
  • Specifically targets the Node.js ecosystem to gain a foothold in high-privilege developer environments.

• Attack Vector & Execution Mechanics

  • Initial Stage: Installation of brandjacked packages that utilize atob() and eval() to decode and execute Base64-encoded URLs.
  • Secondary Stage: The dropper fetches a Node.js backdoor hosted on www.jsonkeeper.com to collect system telemetry.
  • Final Stage: The backdoor establishes C2 communication with 45.59.163.198:1244 to download the f.js payload into a hidden ~/.vscode directory.
  • Persistence: The malware executes npm install --silent to resolve dependencies and runs as a detached background process for persistent RCE.

• Threat Actor Profile & Impact Scale

  • Attributed to the Lazarus Group, demonstrating a sophisticated approach to software supply chain infiltration.
  • Scale of impact includes dozens of malicious packages, with some achieving up to 500 weekly downloads.
  • Primary risk involves the compromise of developer machines, which often hold secrets, SSH keys, and access to production build systems.

• Indicators of Compromise (IoCs)

  • Network Indicators: C2 server 45.59.163.198:1244 and payload hosting via www.jsonkeeper.com.
  • Host Indicators: Unexpected presence of f.js and package.json within the ~/.vscode folder.
  • Malicious Packages: buffer-utilities, buffer-util-extend, express-denv, jwt-path, webpack-patch, chai-as-patch, chai-beta, react-next-dom, midcore, midcorp, and node-background-invoker-v2.

• Defensive Actions & Mitigation

  • Implement strict dependency pinning and audit package-lock.json files for unauthorized utility packages.
  • Deploy Software Composition Analysis (SCA) tools to detect packages with suspicious behavior or low reputation scores.
  • Monitor developer workstations for unusual outbound network traffic and unauthorized file modifications in hidden configuration directories.