North Korea’s Lazarus Hackers Infiltrate npm with Fake Packages to Hack Developers and Crypto Users

Lazarus Hacking Group Linked to Malicious npm Packages

A new wave of cyberattacks linked to the notorious Lazarus hacking group has surfaced, with six malicious npm packages being used to target unsuspecting developers.

Discovered by the Socket Research Team, these packages are designed to steal sensitive information, including credentials and cryptocurrency data.

The malicious code has already been downloaded over 330 times, highlighting the extent of the threat.

Malicious npm Packages on the Rise

The six packages identified in the attack bear a striking resemblance to legitimate ones, using typosquatting tactics to deceive developers into installing them.

These packages, including "is-buffer-validator" and "auth-validator," are designed to infiltrate systems and steal crucial data, such as login credentials, cryptocurrency wallet information, and browser data.

In addition, the malware deployed by these packages also contains backdoors for remote access, creating long-term vulnerabilities in affected systems.

The affected npm packages were named in a way that would make them appear legitimate to developers searching for common utilities.

The packages included:

• is-buffer-validator: A malicious version of the popular "is-buffer" library used to steal credentials.
• yoojae-validator: A fake validation library designed to collect sensitive data.
• event-handle-package: Disguised as an event handler, it actually deploys a backdoor.
• array-empty-validator: A fraudulent package to steal browser and system credentials.
• react-event-dependency: Posing as a React utility, it executes malware to compromise systems.
• auth-validator: Mimicking authentication tools, this package is designed to steal login data.

Targeting Developers and Crypto Users

The attack, while aimed at developers, also poses a significant risk to cryptocurrency users.

The malware targets browser profiles on Chrome, Brave, and Firefox, seeking out stored login information, cookies, and history.

On macOS, it attempts to extract keychain data.

Additionally, the packages are programmed to harvest cryptocurrency wallet data, specifically targeting Solana and Exodus wallets.

According to the Socket report, the malware systematically searches through system directories, extracting files like "Login Data" and "id.json" from Solana wallets, all the while running undetected.

The report explains,

“The code is designed to collect system environment details, including the hostname, operating system, and system directories.”

Code enabling the download of harmful software. (Source: Socket)

The Lazarus Group’s Signature Tactics

While attribution of this attack to Lazarus remains challenging, the group’s history of similar operations raises alarm.

Lazarus has long been known for targeting software registries like npm, GitHub, and PyPI to spread malicious code.

Previous campaigns have been linked to high-profile attacks, including the massive $1.5 billion crypto heist involving the Bybit exchange.

Despite not being linked to this latest breach, the group's ongoing activities in the cryptocurrency space are of particular concern.

The threat actors behind this latest attack created and maintained GitHub repositories for five of the six packages, making them appear legitimate to developers.

This strategy increases the chances of the packages being integrated into legitimate codebases, making detection even more difficult.

As part of their ongoing efforts, the Socket team has reported the malicious repositories and user accounts, petitioning for their removal from npm and GitHub.

However, at the time of reporting, the packages remain active.

The Ongoing Threat of Lazarus

The Lazarus group, often linked to North Korea, is notorious for its sophisticated cyber campaigns, frequently targeting the global cryptocurrency industry.

Despite these high-profile breaches, Lazarus remains a persistent threat due to its ability to operate undetected for extended periods.

Kirill Boychenko, threat intelligence analyst at Socket Security, said,

“The APT group created and maintained GitHub repositories for five of the malicious packages, lending an appearance of open-source legitimacy. This increases the likelihood of the harmful code being integrated into developer workflows.”

In light of these findings, developers are being urged to exercise caution when using third-party packages and ensure they review code carefully to identify potential threats before integrating them into their projects.