A popular developer tool has been infected with malicious code. Aikido researchers discovered ten infected versions of the @7nohe/openapi-react-query-codegen npm package, which is downloaded over 150,000 times a week. Once installed, it could search your computer for keys and access tokens, then use them to spread to other projects.
A popular developer tool has been infected with malicious code. Aikido researchers discovered ten infected versions of the @7nohe/openapi-react-query-codegen npm package, which is downloaded over 150,000 times a week. Once installed, it could search your computer for keys and access tokens, then use them to spread to other projects.
This was reported by cybersecurity company Aikido. The developer of the package himself also published a warning on GitHub, where the incident received a critical rating of 9.6 out of 10.
This package is a tool for React developers. It helps them automatically generate code to work with APIs via TanStack Query, a popular library for React. It makes it easy to retrieve data from the server. For example, loading a list of products, a user profile, or messages via an API. It also helps manage the loading, caching, and re-updating of this data. So a developer can add such a package to their project, and with it, other people's code will be automatically installed.
The problem turned out to be in the automation of releasing new versions through GitHub Actions, a system that can independently perform various actions with the code, including building and publishing new versions of the package.
One of these scripts was configured in a dangerous way. An outside user could leave a special comment under the pull request and start a process that executed the code from that pull request and had the right to publish a new version of the package. The attacker took advantage of this. He added malicious code and, through the official project system, published infected versions of the package to npm, the directory from which developers install such tools into their projects. Because of this, they even had real proof of origin.
The infected package was essentially a credential stealer. It searched the developer's computer for anything that could give access to other services and projects. For example:
Additionally, if the malware found a token that allowed the developer to publish npm packages, it would look for other packages of that user, add its code to them, and publish new infected versions. It could also spread via PyPI and RubyGems, package directories for other programming languages. The scheme was similar with GitHub accounts. After receiving the tokens, the malware would go into the user-accessible repositories and add files there that could run malicious code in various developer tools.
Researchers have already published signs that can be used to check a system for infection. In particular, there may be a file 3FWCvzduYZg.js in the root of the package, and in the system temporary folder there may be directories whose names begin with trinnyyyy-.
Previously, dev.ua wrote about a similar attack on TanStack. Then, attackers exploited a vulnerability in GitHub Actions and were able to publish dozens of infected versions of packages to npm.
