CVE-2024-3094: npm Ecosystem — Worm Enables Credential Theft (June 2024)

CVE-2024-3094 — npm Ecosystem

CVE-2024-3094 is a high-severity vulnerability exploited by the ChainDrop worm, which compromised over 400 npm packages by injecting malicious preinstall scripts. The worm is actively exploited and enables credential theft, developer environment backdoors, and widespread supply chain contamination.

Attack Vector

Attackers injected obfuscated malicious preinstall scripts into npm packages. When developers installed or updated these packages, the scripts executed payloads designed to exfiltrate credentials and authentication tokens. Stolen tokens were then used to republish additional infected packages, enabling rapid, automated propagation. Persistence was established by modifying developer tools and leveraging an Ethereum-based command and control infrastructure. The attack required only that a developer install or update an affected package; no further user interaction was necessary.

Who Is at Risk

All organizations and developers using npm packages are at risk, especially those who installed or updated any of the over 400 compromised packages. The infection is global and not limited to any specific organization or sector. Any environment with automated or manual npm dependency management is susceptible to credential theft and further compromise.

Patch & Mitigate

• Patch: Remove or update all npm packages identified as infected by ChainDrop. Monitor advisories for specific package names and remediation guidance. Immediate action is required.
• Workaround: Temporarily disable npm package installations and updates from untrusted sources. Audit all developer credentials and tokens for unauthorized use.
• Detect: Review npm install logs for unexpected preinstall script execution. Monitor for anomalous outbound connections to Ethereum infrastructure and unauthorized npm publish events.

MITRE ATT&CK

• TA0001 — Initial Access: Malicious npm packages provide a direct entry point into developer environments.
• TA0005 — Defense Evasion: Obfuscated scripts and persistence mechanisms evade detection and removal.
• TA0009 — Collection: Scripts are designed to harvest developer credentials and authentication tokens.

Source: https://unit42.paloaltonetworks.com/sdlc-supply-chain/