A malicious npm package with an encrypted loader has been detected

Security researchers have recorded the spread of a malicious package in the npm repository, using a complex mechanism for hiding the payload, the malicious code is activated only after solving a specific mathematical equation, which allows bypassing automated systems of static analysis. To protect their content from detection, attackers applied the AES-GCM algorithm in combination with the scrypt key generation function. The encrypted loader decrypts the main malicious module directly into memory, minimizing the presence of traces on the disk. A detailed technical analysis of the incident is published in the Safedep report https://safedep.io/mathmain-encrypted-loader/. The use of cryptographic methods in software supply chains is becoming a new standard for bypassing protection systems. In this case, the mathematical check acts as a "logical bomb" that prevents the code from running in sandboxes that cannot simulate interactive interaction or calculations required for decryption. This incident highlights the vulnerability of the npm ecosystem in the face of advanced obfuscation methods. Developers are recommended to conduct audits of dependencies and limit script execution when installing packages, as such masking methods make standard vulnerability scanners virtually useless. A discussion of the technical details of the attack is available on the Hacker News platform https://news.ycombinator.com/item?id=49791378.