ReversingLabs researchers uncovered a malicious npm package named legacyreact-aws-s3-typescript that lurked on npm and used a postinstall script to download and execute a second-stage ELF backdoor. The case highlights typosquatting, downloader/stage behavior, and the need for open-source health checks like Spectra Assure Community to detect and mitigate software supply-chain risks. #legacyreact-aws-s3-typescript #BOZHONPrecisionIndustryTechnologyCo
Keypoints
- ReversingLabs researchers monitor public OSS repositories and frequently identify dozens of malicious packages across npm, PyPI, RubyGems, and more, underscoring the scale challenge of policing open-source ecosystems.
- The npm package legacyreact-aws-s3-typescript mimics the legitimate react-aws-s3-typescript package and uses typosquatting to lure developers, with two npm landing pages appearing identical.
- Post-install scripts in legacyreact-aws-s3-typescript run after installation, download an ELF file, and execute it, signaling a second-stage payload/backdoor.
- The second-stage backdoor opens a socket, connects to 91[.]238[.]181[.]250, and executes/receives commands through /bin/sh, showing a direct remote-control capability.
- Earlier versions (1.1.x series) of the malicious package were clean, while malicious updates appeared in 1.2.1, 1.2.2, and culminated in 1.2.4; some versions were published and removed within days/weeks.
- Typosquatting and deception are central to the campaign, with the malicious package leveraging “legacy” naming to appear as a continuation of the legitimate package.
- Spectra Assure Community provides a free risk assessment portal to evaluate package risk across npm, PyPI, and RubyGems, helping developers detect malware, tampering, and vulnerabilities before use.
MITRE Techniques
- [T1105] Ingress Tool Transfer – Postinstall script downloads an ELF format file and executes it. “the postinstall script runs and downloads an ELF format file and executes it.”
- [T1059.004] Unix Shell – The second-stage backdoor opens a socket and “received commands through /bin/sh.”
- [T1036] Masquerading – Typosquatting to impersonate a popular package; “typosquatting, in which a malicious or suspicious package adopts a name that is close — or identical to — a popular, widely used package” and two npm landing pages looked identical.
Indicators of Compromise
- [SHA1] Second stage payload – 6a590acdf4051bf40794671a4bfc6c3009de71f4
- [IP address] Command and control – 91[.]238[.]181[.]250