Rewterz Threat Alert – Malicious NPM Packages Install njRAT

Severity

High

Analysis Summary

New malicious NPM packages have been discovered that install the njRAT remote access trojan that allows hackers to gain control over a computer. NPM is a JavaScript package manager that allows developers and users to download packages and integrate them into their projects. As NPM is an open ecosystem, anyone can upload a new package without being reviewed or scanned for malware. This makes it easier for threat actors to upload malicious packages. The recently discovered malicious NPM packages were masquerading as a legitimate tool to make databases out of JSON files. They look like harmless packages that could be used to add new functionality to a project. When installed, njRAT gives the threat actor full remote access to a victim’s computer, where they can perform the following malicious behavior:

• Modify the Windows Registry
• Create and delete files
• Upload files
• Execute commands
• Get information about the computer
• Take control over the computer
• Log keystrokes
• Steal passwords
• Kill processes
• Take screenshots

Impact

• Unauthorized Remote Access
• System Takeover
• Unauthorized Command Execution
• Credential Theft
• Data Manipulation
• Information Disclosure

Indicators of Compromise

IP

• 46[.]185[.]116[.]2

MD5

• 7e952af5e150618e282f8586bc6a7d21
• b131dc177af1c2bb38ffc9da6c5b3989

SHA-256

• d6c04cc24598c63e1d561768663808ff43a73d3876aee17d90e2ea01ee9540ff
• 86c11e56a1a3fed321e9ddc191601a318148b4d3e40c96f1764bfa05c5dbf212
• 89fef995339abb188a5a84ba8078c0f9e9927d14fb99c1bb93493442365055cf

SHA1

• c4906e174ae7673a50a9dc52960505647ff6f723
• fab5d5403369f6f9c41495d7492eb8ab596d11d7

Remediation

• Block the threat indicators at their respective controls.
• As malicious NPM projects utilize names similar to legitimate projects, pay close attention to the packages before integrating them into your projects.