Sponsored Session: Malicious Package Trends Compared With Malware Evolution
summary
Claim: registries see about 22 malicious packages daily (≈2% of npm uploads); first wave in 2017 was 37 packages. Common attack vectors are typo‑squatting, brand‑jacking, dependency hijacking/confusion. Typical technique: malicious postinstall scripts exfiltrating env vars (base64/hex obfuscation, delayed execution) sending data to webhooks like pipedream.net and requestbin.net. Objectives favor reconnaissance, credential/Discord account theft and crypto‑mining; ransomware is rare. Defenses: registry hygiene, verify sources, delay installs, take over or abandon abandoned packages, and use package‑focused security tools derived from EDR/XDR.
AI-written summary · about
chapters (14)
- 0:00Start
- 11:50The Trends Analysis of Malicious Package Compared to the Overall Malware Evolution
- 12:59Dependency Hijacking
- 13:29Dependency Confusion
- 15:01Malicious Techniques
- 15:56Objective of Malicious Package
- 17:13Malware Trends
- 18:44The Malicious Techniques of Malwares
- 21:03Attack Vector Comparison
- 21:48Typo Squatting
- 22:48Malicious Techniques Comparison
- 26:01Vulnerability Exploitation
- 29:43Adware
- 35:31Q a
related talks
41mMalicious Modules on npm - a series of unfortunate events
32mIt's a Jungle Out There! – Open Source Supply Chain Attacks
39m"Malice in the Modules" - How NPM Became a Supply-Chain Battleground?
47mBlack Clouds and Silver Linings in Node.js Security
29mThink Like an Attacker: Why Your npm install Is a Hacker's Dream
28mnpm Security: Key Threats & Real Cases | Anastasiya Egorova #JSConfAM25
29mAll your packages are belong to us - Protecting your npm dependencies
20mBuilding a Threat Model & How npm Fits Into It