A dangerous npm package called "indexed-btree" has been spotted embedding its malicious activities within application code, instead of relying on lifecycle scripts. "For threat actors, this frequently enables them to automatically execute malicious code without user consent during the installation of a malicious package." The latest findings from the software supply chain security company reveal that bad actors are adapting to this change, opting to incorporate malicious code directly within the library rather than relying on install hooks.
Malware is designed to fingerprint the host, transmit details to a hard-coded Slack channel and Telegram bot, utilize the EtherHiding technique to pull next-stage, encrypted blobs from a smart contract deployed on Sepolia testnet, and finally merge them to form the second-stage payload.
A defining trait of PolinRider is the threat actor's pattern of compromising developer accounts to inject malicious content into source code repositories and employ routine developer actions, such as cloning a repository or opening it in an integrated development environment (IDE), as triggers to activate the infection chain. This often entails rewriting Git history, concealing payloads within configuration or font files, setting up malicious VS Code auto-run tasks, and relying on takedown-resistant techniques like EtherHiding and its stealth-focused successor, NullReceiver, for staged-payload delivery via the blockchain. Malicious changes were introduced via the LaHiRu developer account.
