Over a Dozen Malicious NPM Packages Caught Hijacking Discord Servers

At least 17 malware-laced packages have been discovered on the
NPM package Registry, adding to a recent barrage of malicious
software^[1] hosted and delivered
through open-source software repositories such as PyPi and
RubyGems.

DevOps firm JFrog said the libraries, now taken down, were
designed to grab Discord access tokens and environment variables^[2]
from users’ computers as well as gain full control over a victim’s
system.

“The packages’ payloads are varied, ranging from infostealers up
to full remote access backdoors,” researchers Andrey Polkovnychenko
and Shachar Menashe said in a report^[3]
published Wednesday. “Additionally, the packages have different
infection tactics, including typosquatting, dependency confusion^[4]
and trojan functionality.”

The list of packages is below –

• prerequests-xcode (version 1.0.4)
• discord-selfbot-v14 (version 12.0.3)
• discord-lofy (version 11.5.1)
• discordsystem (version 11.5.1)
• discord-vilao (version 1.0.0)
• fix-error (version 1.0.0)
• wafer-bind (version 1.1.2)
• wafer-autocomplete (version 1.25.0)
• wafer-beacon (version 1.3.3)
• wafer-caas (version 1.14.20)
• wafer-toggle (version 1.15.4)
• wafer-geolocation (version 1.2.10)
• wafer-image (version 1.2.2)
• wafer-form (version 1.30.1)
• wafer-lightbox (version 1.5.4)
• octavius-public (version 1.836.609)
• mrg-message-broker (version 9998.987.376)

As prior^[5]
research^[6]
has established^[7], collaboration and
communication tools like Discord and Slack have become handy
mechanisms for cybercriminals, with Discord servers integrated into
the attack chains for remotely controlling the infected machines
and even to exfiltrate data from the victims.

“Cyber criminals are using Discord CDN^[8]
to host malicious files as well as for command-and-control
(C&C) communication,” cybersecurity firm Zscaler noted^[9]
in an analysis earlier this February. “Due to the static content
distribution service, it is highly popular among threat actors to
host malicious attachments that remain publicly accessible even
after removing actual files from Discord.”

In light of these disclosures, it’s no surprise that the theft
of Discord access tokens could enable threat actors to use the
platform as a covert data exfiltration channel, distribute malware
to other Discord users, and even sell Discord Nitro premium
accounts to other third-parties, who can then use them for their
own campaigns.

Even more troublingly, the package “prerequests-xcode”
functioned as a full-fledged remote access trojan, a Node.JS port
of DiscordRAT^[10], that’s equipped to
capture screenshots, gather clipboard data, execute arbitrary
VBScript and PowerShell code, steal passwords, and download
malicious files, effectively granting the adversary the ability to
take over the developer’s system.

If anything, the development adds to an increasingly “disturbing
trend” of using rogue packages as a stealthy compromise vector to
facilitate an array of malicious activities, including supply-chain
attacks.

“Public repositories have become a handy instrument for malware
distribution: the repository’s server is a trusted resource, and
communication with it does not raise the suspicion of any antivirus
or firewall,” the researchers said. “In addition, the ease of
installation via automation tools such as the NPM client, provides
a ripe attack vector.”