Inside a Tor Backed Supply Chain Worm

MITRE Techniques

• [T1195.001 ] Supply Chain Compromise: Compromised a public npm package to distribute malicious code, using a typosquatted library to reach downstream developers (‘published crypto-javascri to the public npm registry…’).
• [T1036.005 ] Match Legitimate Name or Location: Used the near-identical name crypto-javascri to imitate crypto-js and evade casual review (‘one character removed from the widely used crypto-js library’).
• [T1552.001 ] Credentials In Files: Read stored tokens from ~/.npmrc and ~/.git-credentials (‘opens two files: ~/.npmrc… ~/.git-credentials…’).
• [T1078 ] Valid Accounts: Validated stolen npm and GitHub tokens and used them to publish packages under the victim’s identity (‘The victim’s token signs the publish.’).
• [T1505.001 ] SQL Stored Procedure / Server Software Component: Server-Side Code Execution: Injected itself into victim-maintained packages and added a preinstall hook to execute automatically (‘Adds “preinstall”: “./.claude/binary” to the package’s scripts field’).
• [T1546.016 ] Event Triggered Execution: Installed execution through Claude Code SessionStart and VS Code folderOpen triggers (‘Claude Code evaluates .claude/settings.json… on every session start’; ‘VS Code’s runOn: folderOpen executes the task automatically’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task: Achieved persistence and repeated execution through user-level systemd service behavior (‘Restart=always ensures it recovers from kills’).
• [T1105 ] Ingress Tool Transfer: Downloaded tarballs, unpacked them, and repackaged them with the malware inserted (‘Downloads the current published tarball… Repack and publish’).
• [T1027 ] Obfuscated Files or Information: Used high-entropy embedded data and hex-encoded Python payloads to hide functionality (’embedded within this region… lies a specifically placed hex-encoded Python payload’).
• [T1090.003 ] Proxy: Multi-hop Proxy: Used Tor hidden services as the C2 channel to hide infrastructure (‘Using Tor as the command-and-control (C2) channel gives the attacker both anonymity and resilience’).
• [T1041 ] Exfiltration Over C2 Channel: Sent stolen credentials and operational data through the same Tor-based command channel (‘maintains a heartbeat’; ‘builds a circuit to a hidden service’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks: Checked for cloud metadata endpoints and exited if not present to avoid analysis (‘If no cloud environment is detected, it exits cleanly’).
• [T1055 ] Process Injection: Injected shellcode-like functionality via a staged payload chain (‘deliver the Stage 3 shellcode’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder: Established user-level startup persistence via copied binaries and service files in startup locations (‘~/.local/bin/systemd-broker’ … ‘~/.config/systemd/user/systemd-broker.service’).
• [T1036.004 ] Masquerading: Masquerade Task or Service: Named the persistence component systemd-broker to resemble legitimate system components (‘systemd-broker.service’).