A whole host of crypto npm packages have been compromised

News
By
published

Someone's trying to steal information from crypto projects

A white padlock on a dark digital background.
(Image credit: Shutterstock.com)

A number of npm packages published by a major cryptocurrency exchange have been compromised and updated to carry malicious code

Decentralized cryptocurrency exchange (DEX) dydX tweeted its discovery of the compromise, and how it was acting to remedy the problem. 

“At 6:14AM EST, we identified malicious versions published to a number of dYdX NPM packages that were quickly removed,” its tweet read. “All funds are SAFE, our websites/apps have NOT been compromised, the attack did NOT impact smart contracts.”

Multiple packages spreading infostealers

Further explaining how user funds aren’t compromised, the company said: “Reminder that dYdX does not have custody of user funds, which are deposited directly to a smart contract on the blockchain.”

Cybersecurity researcher Maciej Mensfeld of security firm Mend and Difend.io, found that some packages contained code that would run information stealing malware when run. He found three packages that were hijacked to be used in identity theft attacks.

  • @dydxprotocol/solo - versions 0.41.1, 0.41.2
    @dydxprotocol/perpetual - versions 1.2.2, 1.2.3

Allegedly, the package '@dydxprotocol/node-service-base-dev' was also compromised, but that one has since been pulled from the platform. 

The packages are described as "Ethereum Smart Contracts and TypeScript library used for the dYdX Solo Trading Protocol." The solo package, the publication found, is used by at least 44 GitHub repositories, being built by “multiple crypto platforms.”

Read more

> A nasty new infostealer malware is landing in email inboxes

> A nasty new infostealer malware is landing in email inboxes

> These are the best endpoint protection services around

Apparently, this is not the first time threat actors were trying to smuggle this identical malicious code into various packages. In fact, BleepingComputer claims to have seen code “strikingly identical” to this one in the malicious “PyGrata” Python packages that were stealing Amazon Web Services (AWS) credentials, environment variables, as well as SSH keys. 

Code repositories are often the targets of malicious actors who sometimes build malicious versions of popular repositories and give them similar names, in hopes of overworked/reckless developers unknowingly picking the wrong one.

Via: BleepingComputer

TOPICS
Sead Fadilpašić

Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.