The Growing Threat of Poisoned Patches in Open Source Software

In recent years, open-source software (OSS) has become an integral part of the development world, offering easy access to reusable code. However, with this accessibility comes the risk of malicious actors exploiting these platforms for their gain. While traditional attacks on open-source repositories, like those on npm, have been somewhat mitigated, cybercriminals are now pivoting to a new, more stealthy strategy. This strategy involves offering malicious “patches” for locally installed software. The subtlety of this attack method makes it far more dangerous and harder to detect.

Understanding the New Malicious Strategy: Poisoned Patches for Installed Software

Researchers at ReversingLabs have recently uncovered a new trend in malicious software distribution—poisoned patches targeting locally installed programs. Unlike traditional attacks where malicious software is introduced directly into a package, this new technique involves distributing updates or patches that modify trusted software already installed on a victim’s computer.

One such malicious package, “pdf-to-office,” was recently discovered on the npm website. Marketed as a productivity tool to convert PDF files to Microsoft Office formats, it gained popularity quickly, with around 200 downloads within just a week. However, the package didn’t do what it claimed. Instead of performing the intended task, the package executed an obfuscated JavaScript file, “pdftodoc,” which silently searched for cryptocurrency wallet applications like Atomic and Exodus.

Upon finding these wallets, the malicious code would replace certain legitimate files with Trojanized versions. These compromised files would not only function as normal but also redirect outgoing cryptocurrency transactions to the attacker’s own wallet. The most insidious part of this attack is its persistence: even if the victim removes the malicious “pdf-to-office” package, the compromised wallet software would continue to operate under the attacker’s control. The only way to fully eradicate the malware would be for the victim to completely uninstall and reinstall their wallet software.

This method is more subtle than traditional malware, which tends to be more easily detected. Since the malicious patch is injected into existing, trusted software, the attack often goes unnoticed for long periods, making it particularly dangerous.

The “pdf-to-office” package is not an isolated incident. In March, ReversingLabs discovered two other malicious packages—“ethers-providerz” and “ethers-provider2”—that targeted Ethereum developers. These packages, similar to the “pdf-to-office” package, injected malicious patches into the “ethers” program, a widely used library for Ethereum blockchain development. The result? A reverse shell was created, granting attackers access to the infected machine.

This trend signals a shift in attack tactics within the open-source community. The attackers are increasingly focusing on infecting widely used, trusted software rather than creating entirely new malware.

What Undercode Says:

The evolving nature of cyberattacks in the open-source ecosystem has profound implications for both developers and users. Poisoned patches are particularly concerning because of their stealth and persistence. Unlike conventional malware, which can often be detected quickly due to its anomalous behavior, these malicious patches work by exploiting the trust users place in their existing software. Since the infected packages don’t appear malicious and often behave like legitimate updates, they blend seamlessly into a user’s system.

One of the core issues with these types of attacks is that they remain under the radar for extended periods. Malicious actors have perfected the art of injecting malware into trusted applications, which often fly under the radar of standard antivirus solutions. The affected software may continue running seemingly as expected, with the only real symptom being redirected crypto transactions or system vulnerabilities that aren’t immediately obvious to the user.

This new attack vector also takes advantage of the open-source community’s reliance on shared, reusable code. Because open-source libraries and packages are freely accessible, it’s difficult to ensure the legitimacy of every update or patch. While developers often depend on the open-source ecosystem for rapid innovation, they also open themselves up to these kinds of attacks. Vigilance and thorough inspection of any third-party packages are more crucial than ever.

As Lucija Valentic from ReversingLabs points out, staying aware of what goes into the development cycle is essential. Developers should be particularly cautious of packages that are not well known or have a limited number of versions. Furthermore, they should always review the functionality of any package before integrating it into their projects.

This evolving threat landscape highlights the need for robust security practices in the open-source community. As open-source software continues to grow in popularity, it is critical that both developers and end-users remain vigilant and proactive in identifying potential risks. Regular audits, heightened awareness of the software supply chain, and a healthy skepticism of seemingly innocuous patches will be key in mitigating the risks posed by poisoned patches.

Fact Checker Results:

Malicious packages targeting locally installed software are indeed on the rise, as seen with “pdf-to-office” and “ethers-providerz.”
These types of attacks are stealthier and more persistent than traditional malware, making them harder to detect.
Recommendations for developers include more thorough vetting of third-party packages and avoiding those with limited community support or versions.