25 Malicious JavaScript Libraries Distributed via Official NPM Package Repository

Another batch of 25 malicious JavaScript libraries have made
their way to the official NPM package registry with the goal of
stealing Discord tokens and environment variables from compromised
systems, more than two months after 17 similar packages^[1]
were taken down.

The libraries in question leveraged typosquatting techniques and
masqueraded as other legitimate packages such as colors.js,
crypto-js, discord.js, marked, and noblox.js^[2], DevOps security firm
JFrog said, attributing the packages as the work of “novice malware
authors.”

The complete list of packages is below –

• node-colors-sync (Discord token stealer)
• color-self (Discord token stealer)
• color-self-2 (Discord token stealer)
• wafer-text (Environment variable stealer)
• wafer-countdown (Environment variable stealer)
• wafer-template (Environment variable stealer)
• wafer-darla (Environment variable stealer)
• lemaaa (Discord token stealer)
• adv-discord-utility (Discord token stealer)
• tools-for-discord (Discord token stealer)
• mynewpkg (Environment variable stealer)
• purple-bitch (Discord token stealer)
• purple-bitchs (Discord token stealer)
• noblox.js-addons (Discord token stealer)
• kakakaakaaa11aa (Connectback shell)
• markedjs (Python remote code injector)
• crypto-standarts (Python remote code injector)
• discord-selfbot-tools (Discord token stealer)
• discord.js-aployscript-v11 (Discord token stealer)
• discord.js-selfbot-aployscript (Discord token stealer)
• discord.js-selfbot-aployed (Discord token stealer)
• discord.js-discord-selfbot-v4 (Discord token stealer)
• colors-beta (Discord token stealer)
• vera.js (Discord token stealer)
• discord-protection (Discord token stealer)

Discord tokens have emerged as lucrative means for threat actors
to gain unauthorized access to accounts sans a password, enabling
the operators to exploit the access to propagate malicious links
via Discord channels.

Environment variables, stored as key-value pairs^[3], are used to save
information pertaining to the programming environment on the
development machine, including API access tokens, authentication
keys, API URLs, and account names.

Two rogue packages, named markedjs and crypto-standarts, stand
out for their role as duplicate trojan packages in that they
completely replicate the original functionality of well-known
libraries marked^[4]
and crypto-js^[5], but feature additional
malicious code to remotely inject arbitrary Python code.

Another malicious package is lemaaa, “a library which is meant
to be used by malicious threat actors to manipulate Discord
accounts,” researchers Andrey Polkovnychenko and Shachar Menashe
said^[6]. “When used in a certain
way, the library will hijack the secret Discord token given to it,
in addition to performing the requested utility function.”

Specifically, lemaaa is engineered to use the supplied Discord
token to siphon victim’s credit card information, take over the
account by changing the account password and email, and even remove
all of the victim’s friends.

Vera.js, also a Discord token grabber, takes a different
approach to carry out its token theft activities. Instead of
retrieving the information from local disk storage, it retrieves
the tokens from a web browser’s local storage.

“This technique can be helpful to steal tokens that were
generated when logging using the web browser to the Discord
website, as opposed to when using the Discord app (which saves the
token to the local disk storage),” the researchers said.

If anything, the findings are the latest in a series of
disclosures uncovering the abuse of NPM to deploy an array of
payloads ranging from info-stealers up to full remote access
backdoors, making it imperative that developers inspect their
package dependencies to mitigate typosquatting^[7]
and dependency confusion^[8]
attacks.