The Risks of Blind Trust in Code from Strangers

### Overview In this talk, Jossef (Head of Supply Chain Security Research and Engineering at Checkmarx) and Tal (Security Researcher at Checkmarx) examine the risks of blind trust in open-source software dependencies. Rather than dealing with standard software vulnerabilities, the speakers focus on active dependency threats and malicious packages uploaded to registries like npm and the Python Package Index (PyPI). They illustrate how the open-source packaging ecosystem lacks upfront identity and metadata verification, enabling threat actors to exploit trust through account takeovers, protestware, metadata manipulation, typosquatting, and complex multi-stage malware.

### Key Topics - **Limits of Popularity:** High download counts and long-standing reputations do not guarantee safety. Legitimate packages can be hijacked via account takeovers or sabotaged by original maintainers. - **StarJacking and Metadata Spoofing:** Attackers exploit the lack of package registry validation to tie new malicious packages to unrelated, highly starred GitHub repositories. - **Evolving Attack Techniques:** Attackers increasingly deploy evasion mechanisms including Domain Generation Algorithms (DGA), steganography, polymorphic code payloads, malicious browser extensions, and clipboard manipulation targeting cryptocurrency wallets. - **Malware vs. Vulnerabilities:** Malicious dependency injection differs fundamentally from handling traditional software CVEs and demands active incident response. - **Collaborative Defense:** Industry initiatives like SCAR (Supply Chain Attack Research) and tools like Overlay bring proactive package health vetting directly into developer workflows.

### Technical Details - **Account Takeover and Sabotage:** Tal highlighted the compromise of `UAParser.js` after an attacker gained access to maintainer Faisal's npm account (sold on underground forums without 2FA), injecting a password stealer and crypto miner while keeping original functionality intact. Similar code appeared in `coa` and `rc`. In contrast, the maintainer of `node-ipc` deliberately added code that checked user geolocation; if located in Russia or Belarus, it attempted to overwrite system files and write heart emojis as protestware. - **StarJacking Demonstration:** The speakers showcased how easily PyPI allows users to link any GitHub repository metadata. By pointing a new package (`supplychaindemo`) to an unrelated repository (`the-economist-ebooks`), the package instantly displayed over 9,000 GitHub stars despite being newly published with a simple payload fetching code from Pastebin. - **Typosquatting and Command & Control:** Attackers spoofed names like `falsk` for Flask. Upon Windows installation, the package fetched an undetected C++ executable from GitHub that communicated with an IP Logger service, supported DDoS capabilities, and utilized a sequence of 23 unoccupied GitHub accounts as a fallback DGA mechanism. The speakers also tracked `W4SP Stealer`, which hid stagers inside images using steganography, delivered polymorphic payloads that evaded EDRs, and exfiltrated stolen browser credentials via Discord webhooks. - **Attacker Interception & Large-Scale Campaigns:** In an investigation into targeted packages aimed at organizations like Aidoc, the team simulated an infected client connecting to a base64 bash reverse shell, baiting the threat actor before the attacker panicked and removed the shell. In another campaign involving over 900 packages and 22 PyPI users created on November 1, 2022, Tal scraped 257 PyPI Sitemap pages (surveying roughly 600,000 users) to narrow down over 300 connected threat actor accounts. This investigation connected overlapping activity from the group LofyGang, which operated a Discord server with over 14,000 members and distributed malicious tools with embedded dependencies targeting Discord Nitro and PayPal.

### Takeaways - **Reduce Blind Trust:** Organizations and developers must stop assuming popular or long-standing packages are safe, or that registries actively vet package contents. - **Differentiate Malware from CVEs:** Malicious packages are not standard vulnerabilities that can be mitigated with risk acceptance; finding one in an environment requires immediate investigation, evidence gathering, credential rotation, and malware eradication. - **Integrate Vetting in Developer Workflows:** Developers should adopt vetting tools before running install commands. The speakers highlighted the open-source browser extension Overlay, which consolidates package health data (from sources like Google Open Source Insights, Debricked, and Snyk Advisor) to flag risky packages directly in the browser.