Hackers Weaponize Pentesting Tools With Malicious npm, PyPI, & Ruby Packages

Threat actors leverage Out-of-Band Application Security Testing (OAST) techniques in the npm, PyPI, and RubyGems ecosystems to carry out multi-stage attacks, establish command and control (C2) channels, and exfiltrate sensitive data.

OAST tools, which were originally developed by PortSwigger’s Burp Collaborator and subsequently adopted by services such as Project Discovery’s interact.sh, allow ethical researchers to do HTTP requests, DNS lookups, and other network interactions outside of the parameters of conventional testing. 

Unfortunately, threat actors also appropriate these potent skills and use them to discover critical areas in victims’ systems or to exfiltrate data covertly.

Weaponizing npm, PyPI, And Ruby Exploit Packages

The npm package adobe-dcapi-web pretends to be related to Adobe APIs by utilizing deceptively high version numbers (e.g., 99.99.95—99.99.99) to trick developers and automated scripts into believing it is the “latest” update.

Socket researchers report that the package includes obfuscated JavaScript code that identifies virtualization environments, examines the system’s location, and stops execution if it detects a Russian locale.

Investigate Real-World Malicious Links, Malware & Phishing Attacks With ANY.RUN – Try for Free

The malicious code exfiltrates sensitive data to oastify.com when these checks are successful.

Furthermore, the threat actor constructed a monoliht that closely resembles the actual library monolith by reversing one letter in the PyPI package monoliht.

The malicious script’s domains are used to discreetly collect metadata from the victim, including their hostname, username, and current working directory.

The RubyGems package includes chauuuyhhn, nosvemosssadfsd, and holaaaaaafasdf.

These gems have embedded scripts that are intended to exfiltrate private data, including as hostnames, external IP addresses, user environment variables, current working directories, and folder names, to an attacker-controlled oastify.com endpoint through DNS queries. 

This technique enables the threat actor to conduct initial reconnaissance with a decreased chance of discovery because DNS traffic frequently seems harmless to simple intrusion detection systems.

Researchers anticipate that threat actors will keep using the same out-of-band testing methods for illicit purposes in future.

Hence, implement solutions that can give you real-time insights into the integrity of your software supply chain and warn you of any suspicious or malicious components before they have a chance to establish a foothold.

Indicators Of Compromise (IOCs)

Malicious npm Package: adobe-dcapi-web
Malicious PyPI Package: monolith
Malicious RubyGems Packages: chauuuyhhn, nosvemosssadfsd, holaaaaaafasdf

Malicious OAST Endpoints:

• gbv6crrcecvsm77b41bxoih8wz2rqie7.oastify[.]com
• sbfwstspuutiarcjzptfenn9u0dsxhjlu.oast[.]fun
• dnipqouebm-psl.cn.oast-cn.byted-dast[.]com
• oqvignkp58-psl.i18n.oast-row.byted-dast[.]com
• kc0262r8oypagq3e8f89uaqmodu4i16q.oastify[.]com

Find this News Interesting! Follow us on Google News, LinkedIn, and X to Get Instant Updates!