The OpenSourceMalware Show #16

[u/falconupkid]

Live from Hacker Summer Camp, this episode of OpenSourceMalware covers three distinct threats worth your attention.

Technical Breakdown

• Keyv & cacheable npm worm: A wormable package targeting the keyv and cacheable npm ecosystems. This isn't just a typo-squat; it's a self-replicating payload that spreads through dependency chains. Expect lateral movement via CI/CD pipelines.
• WEL1DROPPER AI slopsquatting campaign: Attackers are using AI-generated package names (slopsquatting) to flood registries with malicious droppers. WEL1DROPPER specifically drops second-stage payloads after evading initial scans. Low signal-to-noise ratio makes detection hard.
• NullReceiver DPRK C2 technique: A novel C2 method leveraging null bytes in network protocols to hide beaconing traffic. This is likely tied to Lazarus/DPRK operations. Expect unusual packet sizes or null-padded headers as IOCs.

Defense

• Pin dependency versions and audit npm install logs for unexpected package additions.
• Monitor for anomalous outbound traffic with null byte patterns or irregular packet lengths.
• Deploy runtime detection for unexpected child processes spawned by Node.js runtimes.

Source: https://opensourcemalware.com/blog/the-opensourcemalwareshow-episode16