Recent supply chain attacks on NuGet and npm have targeted developers by exfiltrating sensitive application data and deploying cross-platform malware.

Malicious NuGet Packages: ASP.NET Data Theft

Researchers at Socket identified four NuGet packages targeting ASP.NET developers to steal sensitive data and create backdoors.

• Mechanism: NCryptYo acts as a first-stage dropper creating a local proxy for C2 communication, while companion packages DOMOAuth2_ and IRAOAuth2.0 create persistent authorization backdoors.
• Persistence: The attack employs advanced Just-In-Time (JIT) compiler hooking to evade detection in production environments.

npm Malware: “SANDWORM_MODE” and “ambar-src”

Recent campaigns on the npm registry, as reported by Socket and Tenable, included:

• SANDWORM_MODE: A self-propagating worm in 19 typosquatted packages (e.g., support-color) that exfiltrates AI API keys and GitHub tokens.
• ambar-src: A high-download package (over 50,000) that installed cross-platform malware for Windows (shellcode), Linux (SSH reverse shell), and macOS (Apfell JXA agent).
• Stealth Tactics: buildrunner-dev was noted for hiding payloads within PNG image pixel values.