What happened

OSV has marked six npm packages in the @ecg-internal scope as malicious: adobe-dmp-js, aurora-js-formatters, favourites-ui, js-react-i18n, media-util-js-lib and reviews-dialog-ui. Amazon Inspector is credited with finding them.

Each one runs a beacon.cjs script after install that sends the machine's hostname, install path, working directory and Node version, unencrypted, to the address http://185.158.107.175:8787/_ah/dc. The main module fires the same beacon when it is loaded, so it still runs in builds that skip install scripts with --ignore-scripts. Otherwise the code is an empty stub that returns do-nothing functions, so builds keep working.

The internal-looking scope and versions as high as 99.0.1 are meant to win over a private package with the same name, and the analysis calls this a dependency-confusion probe for mapping internal build systems.

What to do

  1. GitHub's malware advisory says to treat any computer that installed one of these packages as fully compromised and to rotate its secrets and keys from a different computer.
  2. Remove the package, keeping in mind that removal alone may not undo everything it did.

Packages named

Named in the source, not checked: this brief has a single source so far. Cloak Watch looks for these once more sources confirm it.

EcosystemPackageVersions
npm@ecg-internal/adobe-dmp-js0.0.11.0.12.0.02.0.199.0.1
npm@ecg-internal/aurora-js-formatters1.0.02.0.02.0.13.0.099.0.1
npm@ecg-internal/favourites-ui0.0.11.0.01.1.02.0.02.0.13.0.099.0.1
npm@ecg-internal/js-react-i18n1.0.01.0.11.1.02.0.099.0.1
npm@ecg-internal/media-util-js-lib0.0.11.0.11.1.02.0.02.0.13.0.099.0.1
npm@ecg-internal/reviews-dialog-ui0.0.11.0.01.0.12.0.02.0.13.0.099.0.1

Indicators of compromise

Shown defanged so they can't be clicked. Copy copies the real value. Every indicator appears in the cited source.

TypeIndicatorNoteCopy
URLhxxp://185[.]158[.]107[.]175:8787/_ah/dcbeacon endpoint receiving installer host details[1]

Sources

Changelog

  1. First published.