Critical npm Supply Chain Attack Uses undicy-http to Deploy RAT

Key Takeaways

• A critical supply chain attack targeting the npm ecosystem leveraged a malicious package named undicy-http.
• The attack deploys a sophisticated Remote Access Trojan (RAT) capable of evading detection and stealing sensitive information.
• Developers using Node.js are at risk, particularly those who may have installed the compromised package.
• Immediate action is required to remove the malicious package, terminate related processes, and secure affected systems and accounts.

Sophisticated npm Supply Chain Attack Delivers Stealthy RAT

A recent and highly concerning supply chain attack has infiltrated the npm package repository, distributing a potent Remote Access Trojan (RAT) through a malicious package identified as undicy-http. This sophisticated threat is designed for stealthy execution and extensive data exfiltration, posing a significant risk to developers and the integrity of their systems.

Attack Mechanics and Evasion Techniques

The undicy-http package, once executed, initiates a multi-stage infection process. Researchers indicate that the malware actively scans for common cybersecurity analysis tools, including Wireshark, IDA Pro, and Ghidra, in an apparent attempt to detect and evade reverse engineering efforts. To further deceive victims, the payload generates a fake “missing DLL” Windows error dialog, a classic social engineering tactic designed to mask its true malicious activities which continue silently in the background.

A particularly advanced component of this attack involves a native binary, chromelevator.exe. This executable employs direct syscalls, bypassing standard ntdll.dll APIs. This technique allows it to circumvent user-mode EDR (Endpoint Detection and Response) and antivirus hooks, making detection and termination significantly more challenging for traditional security solutions.

Payload Capabilities and Data Theft

The RAT delivered by undicy-http is engineered to compromise a wide array of user data and credentials. While specific details on the range of stolen information were not fully enumerated in the source, the comprehensive cleanup steps outlined by researchers strongly suggest that the malware aims to exfiltrate session tokens, passwords, and potentially cryptocurrency wallet information.

What You Should Do

• Immediately Uninstall: Run npm uninstall undicy-http to remove the malicious package from your development environment.
• Terminate Processes: End all active node and wscript.exe processes on affected systems.
• Remove Scheduled Tasks and Registry Keys: Delete the ScreenLiveClient scheduled task and its associated registry key.
• Clean Temporary Files: Remove all VBS files from your temporary folder.
• Reinstall Discord Clients: Reinstall all Discord clients to ensure any injected code is cleared.
• Rotate Credentials: Urgently rotate all passwords, Discord tokens, and session credentials for critical services such as Roblox, Instagram, Spotify, TikTok, Steam, and Telegram.
• Secure Cryptocurrency: If applicable, transfer all cryptocurrency to new wallets with freshly generated seed phrases, ideally on a verified clean machine.
• Block C2 Infrastructure: Block the command-and-control (C2) IP address 24[.]152[.]36[.]243 and domain amoboobs[.]com at your network perimeter.
• System Re-imaging: If chromelevator.exe was executed on a system, a complete system re-imaging is strongly advised. Manual cleanup might not guarantee the full restoration of system trust due to the advanced evasion techniques employed.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.