Hackers Compromise 170 npm Packages to Steal GitHub, npm, AWS, and Kubernetes Secrets

Summary

A group of hackers has compromised over 170 npm packages, injecting malicious code into them to steal secrets from developers' environments. The attack targets GitHub tokens and other sensitive information such as AWS credentials, Kubernetes API keys, and SSH private keys.

Key Points:

• Victim Environment: Developers using the compromised npm packages.
• Attack Vector: Malicious scripts injected into popular npm packages like @npmcli/run-script and @npmcli/query.
• Stolen Information:
  • GitHub tokens
  • AWS credentials
  • Kubernetes API keys
  • SSH private keys
• Malware Components:
  • Cobalt Strike Beacon (C2)
  • Python script for exfiltration

Technical Details:

• The malicious code is designed to run on the victim's machine and exfiltrate sensitive data.
• The attackers use a combination of PowerShell scripts and Python to achieve their goals.
• The malware communicates with C2 servers via HTTP requests.

Mitigation Strategies

• Update Dependencies: Ensure all npm packages are up-to-date.
• Monitor Environment Variables: Regularly check for unauthorized access or changes in environment variables.
• Use Secret Managers: Store secrets

Read the full article at Cyber Security News

---

Want to create content about this topic? Use Nemati AI tools to generate articles, social posts, and more.