Dev, watch out. TrapDoor campaign.
Dev Beware TrapDoor Campaign Hidden Malware Tucked by Software Development Tools Aim for Dev
According to a report by the website CSO Online, Trapdoor has been detected that focuses on attacking software developers by hiding malware in software development workflow packages based on the popular Repo or Repository in the industry and is often used at all stages, such as npm, PyPI, and Crates.io, causing victims to trust and download it. A research team from Socket, a supply chain attack specialist, said that up to 34 malware latent packages have been detected, covering more than 284 versions and Artifact. The malware within these packages is designed to steal classified information such as AWS access passwords, Github access tokens, web browser data, Environment Variables, Cryptokerrency wallet data, and local Configuration data of victims.
According to the research team, malware does not behave like Opportunistic Malware, but penetrates parts of the developer's workflow, such as
Malware on npm uses scripts after installation (Postinstall Scripts).
The malware on PyPi uses the Import-Time Execution method to retrieve (Fetch) and run JavaScript remotely (Remote).
Malware on Crates.io will use scripts created with the Rust language that will run during compilation.
In addition, malware has also been found to interfere with AI-Coding Tools by using Unicode Instructions to edit the files of these tools, such as .cursorrules and CLAUDE.md, which the research team estimated was an attempt to use AI tools to scan the victim's security system for loopholes in the theft of classified information and smuggling it back to the hackers behind it.
According to the research team, the campaign can be called a terrible campaign. The malware can penetrate the Workflow level, making it difficult to detect. Not only can the malware penetrate the victim's machine, it has the ability to use the victim's machine as an entry point to the core structure of software development projects like CI / CD Pipelines and Build Infrastructure.
As a result of the complexity of the malware operations on this campaign, the protection against malware can be complicated as a result. Just locking files or using the EDR or Endpoint Detection and Response is inadequate for the reasons mentioned above. For the entire system to be safe from this malware, security policies must be implemented in a variety of parts, such as strict control of the installation of various Dependencies, scanning all files before the installation is allowed, and providing Least-Privilege Access to various developers, etc. To ensure that the system is safe from malware on this campaign.
