Worm compromises hundreds of popular npm packages | Datadog Security Labs

MITRE Techniques

• [T1195.001] Compromise Software Supply Chain – The actor modified npm packages and published malicious versions to spread the payload (‘compromised hundreds of npm packages and used them to propagate a backdoor’).
• [T1059.004] Command and Scripting Interpreter: Unix Shell – The payload uses shell commands and scripts during execution and collection (‘node setup.mjs through preinstall’, ‘pipelines’, ‘unzip’, ‘sudo python3’).
• [T1059.006] Command and Scripting Interpreter: JavaScript – The loader and second stage execute JavaScript code under Bun and Node.js (‘The loader synchronously starts Bun’, ‘if (responseBody.code) { await eval(responseBody.code); }’).
• [T1105] Ingress Tool Transfer – The loader downloads Bun from an official release URL when it is not installed (‘constructs an official Bun release URL’, ‘The downloader uses a node User-Agent’).
• [T1027] Obfuscated Files or Information – The second stage is heavily obfuscated with Base91 tables, split strings, and flattened state machines (‘Its obfuscation combines a 4,613-entry Base91 string table’).
• [T1053.005] Scheduled Task/Job: Scheduled Task – The malware installs persistence-like hooks through package scripts and startup hooks in project files (‘preinstall’, ‘.vscode/tasks.json’, ‘.claude/settings.json’).
• [T1056] Input Capture – The payload searches for and extracts tokens, secrets, and credentials from files and process memory (‘files, environment variables, runner memory, and cloud secret stores are queried’).
• [T1005] Data from Local System – It reads selected files, environment variables, Kubernetes secrets, and more from the host (‘Full contents of selected files’, ‘entire process.env’).
• [T1071.001] Application Layer Protocol: Web Protocols – Exfiltration and command retrieval occur over HTTPS (‘makes an HTTPS GET to port 443 on /router’).
• [T1106] Native API – The code uses system-native behavior and process mechanisms such as detached execution, unref, and memory access (‘respawns its current executable with the same arguments’, ‘reads each readable mapping through /proc//mem’).
• [T1552.001] Unsecured Credentials: Credentials In Files – It hunts for tokens and secret material in files and histories (‘environment files, shell histories, SSH material, Git, npm, PyPI, cloud, Kubernetes’).
• [T1098] Account Manipulation – The actor uses valid credentials to create branches, releases, workflows, and package publications (‘uses valid npm or GitHub credentials conditionally’).
• [T1190] Exploit Public-Facing Application – The injected GitHub workflow and repository abuse paths leverage exposed services and valid tokens to trigger execution (‘creates a workflow’, ‘downloads and reads the artifact’).
• [T1528] Steal Application Access Token – The malware explicitly looks for npm, GitHub, and cloud tokens and then reuses them for propagation and exfiltration (‘looks for classic GitHub personal access or OAuth tokens’, ‘For each collected token matching npm’s granular-token format’).
• [T1621] Multi-Factor Authentication Request Generation – The npm propagation path requires bypass_2fa access when checking stolen tokens (‘requires a matching record with bypass_2fa: true’).
• [T1213] Data from Information Repositories – It queries GitHub, AWS, Kubernetes, Vault, and Actions stores for secrets (‘GitHub REST endpoints for repository and organization Actions secrets’).