A Malicious Package Found Stealing AWS AIM data on npm has Similarities To Capital One Hack

Imagine a seemingly harmless npm package that secretly steals your AWS credentials, just like the attackers did in the Capital One hack of 2019. 

This isn’t a hypothetical scenario – researchers recently discovered a malicious package with this very capability.

In this article, you’ll learn how the ‘@maui-mf/app-auth’ package functioned as a digital Trojan horse. We’ll explore how it exploited a similar vulnerability to the Capital One attack, and the critical data it targeted. We’ll also discuss the importance of security measures like Mend Supply Chain Defender in protecting your organization from such threats.

This article is part of a series of articles about malicious packages.

The malicious functionality of the @maui-mf/app-auth package

In the latter part of December 2021, the Mend.io research team detected the new release of a package called @maui-mf/app-auth. This package used a vector of attack that was similar to the server side request forgery (SSRF) attack against Capital One in 2019, in which a server was tricked into executing commands on behalf of a remote user, thereby enabling the user to treat the server as a proxy for requests and gain access to non-public endpoints. 

In the case of the @maui-mf/app-auth package, in addition to the thousands of lines of regular JavaScript code related to using React, there were a few special lines of code that ran upon installation of the package. That additional code sent host details while also performing an HTTP request to a certain endpoint. This endpoint data – both host and endpoint path – were obfuscated with base64 to make them harder to detect.

Once decoded, it becomes evident that the request targets an Amazon Web Services (AWS) Metadata Service. The URL was used to provide an HTTP application programming interface (API) for retrieving information like the node’s IP address, placement within the AWS network, hostname and IAM security credentials.

In the case of the @maui-mf/app-auth package, the targeted endpoint returned information about the IAM role assigned to the instance from which the request was made. Left unchecked, the data would be passed on to the external domain “microsoft-analytics.net” via the domain name system (DNS) lookup query.

In case you have any doubt, this was malicious activity. While the data provided by this package wasn’t enough to perform a full SSRF attack, it could be enough to give the attacker knowledge of potential vectors for further exploitation. 

In the parlance of the MITRE ATT@CK framework, this was both an “initial access” and a “discovery” tactic. For instance, by installing the package, an attacker could validate that there are indeed vulnerable machines out there and in turn release a new version of the same package that will contain exploits of those vulnerabilities. That new version could try to elevate the permissions by running a second query to the AWS endpoint to obtain the credentials needed for the exploitation.

Beyond stealing credentials: A landscape of malicious packages

While the ‘@maui-mf/app-auth’ package focused on credential theft, it represents just one type of threat lurking within seemingly legitimate packages. Here are a few more examples that showcase the diverse tactics malicious actors employ:

• License Tampering: Researchers have discovered a new type of malicious code that masquerades as software protection. This code can actually remove essential directories from a project if it detects the software is not licensed during deployment. This tactic disrupts development workflows and highlights the importance of secure coding practices. 
• Hidden Backdoors: Another critical vulnerability involved a compromised version of a popular utility, XZ Utils. This malicious package contained a backdoor that attackers could exploit to gain unauthorized access via SSH. This incident underscores the importance of using trusted repositories and maintaining strong access controls. 

By staying informed about these evolving threats and implementing robust security measures, organizations can significantly reduce their risk of falling victim to malicious packages.

Potential impact and mitigation strategies

An attack using a package like @maui-mf/app-auth could have severe consequences. Stolen AWS credentials could allow attackers to compromise resources within your AWS environment, potentially leading to data breaches or disrupted operations.

Here are some strategies to mitigate the risk of malicious packages:

• Regularly review your project’s dependencies and their licenses.
• Implement code signing to verify the authenticity of packages before installation.
• Train your developers on software supply chain security risks and best practices for secure coding.

Next steps

Software supply chain security is a critical concern in today’s development landscape. By staying vigilant and implementing robust security measures, organizations can significantly reduce their risk of falling victim to malicious packages. 

Learn more with the Mend.io open source risk research report.

Manage open source risk

Read the report