Researchers at Veracode, a code security assessment company, found that the first version of the package was added to the Node Package Manager (NPM) index on March 19 and was benign, as it only collected operating system information from the host. Veracode decoded and deobfuscated the string to find a payload for a sophisticated C2 mechanism that relied on a Google Calendar short link to reach the location hosting the final payload. A malicious package in the Node Package Manager index uses invisible Unicode characters to hide malicious code and Google Calendar links to host the URL for the command-and-control location. On May 7, a new version of the package was published, which featured code for "a sophisticated C2 (command-and-control) mechanism" that delivers the final payload. The researchers say that the request expects a base- encoded stage-2 malware payload in the response body, and likely an initialization vector and a secret key in the HTTP headers - an indication of possible encryption of the final payload. These Unicode characters are normally modifiers, typically used "to provide specific glyph variations in complex scripts." In this case, their role is to facilitate text-based steganography - hiding information in other data. Furthermore, the package is listed as a dependency for four other NPM packages: skip-tot, vue-dev-serverr, vue-dummyy, and 'vue-bit - all pose as accessibility and developer platform engineering tools. At the time of analysis, the researchers could not retrieve the final payload, suggesting that the campaign could be on hold or still in an early stage. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. The package, named os-info-checker-es6, appears as an information utility and has been downloaded more than 1,000 times since the beginning of the month. Using a function called ymmogvj, the URL is decoded to get a malware payload.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 15 May 2025 13:34:53 +0000