New Blog: Malicious dom-utils-lite npm Package Implants SSH Backdoor

Malicious npm Package dom-utils-lite Implants SSH Backdoor in Software Supply Chain Attack

A new threat has emerged in the open-source software supply chain: a malicious npm package, dom-utils-lite, has been identified implanting an SSH backdoor. This attack leverages the package ecosystem to compromise developer systems, potentially impacting projects utilizing Supabase.

Technical Breakdown:

• Attack Type: Software Supply Chain Attack
• Infection Vector: Malicious npm package dom-utils-lite
• Payload: SSH Backdoor
• Context: Identified in relation to Supabase environments, suggesting potential targeting of developers working with Supabase or using Supabase services for command and control/data exfiltration.
• TTPs: Package compromise, backdoor installation. (Specific C2, persistence, or privilege escalation TTPs are not detailed in the summary).
• IOCs: Malicious npm package: dom-utils-lite (Developers should ensure they are not using this specific package or any similar typosquats).

Defense: Implement robust software supply chain security measures, including vetting third-party dependencies, using package integrity checks, and monitoring for suspicious network activity indicative of SSH backdoors.

Source: https://safedep.io/malicious-dom-utils-lite-npm-ssh-backdoor