A recent incident involving a lone attacker has led to the publication of 14 malicious npm packages that mimic well-known libraries from the OpenSearch and Elasticsearch ecosystems. This activity, reported by Microsoft, occurred within a four-hour window and highlights ongoing vulnerabilities in software supply chains.
Details of the Attack
The attacker, using the maintainer alias vpmdhaj, published these packages targeting developers who utilize Amazon Web Services, HashiCorp Vault, GitHub Actions, and the npm registry. Microsoft noted that this suggests the attacker aimed to reach a developer audience likely to possess sensitive cloud credentials.
Malicious Payloads and Techniques
All 14 packages contained a common install-time stager and a second-stage payload designed to harvest credentials specifically from cloud and CI/CD environments. The malicious payload, which is 195 KB in size, executes automatically when users run npm install. This allows the attacker to steal tokens and other secrets, potentially enabling lateral movement across cloud environments.
Methods of Deception
To entice users into installing these malicious packages, the attacker employed typosquatting and lookalike naming conventions. For instance, packages were named similarly to legitimate ones, such as opensearch-setup-tool and elastic-opensearch-helper. Additionally, the attacker spoofed upstream metadata to make the packages appear legitimate, setting their package.json fields to match those of the official OpenSearch project.
Response and Mitigation
All malicious packages have been removed from the npm registry, and Microsoft has published a list of the affected packages. Users who installed or built these packages on or after May 28 are advised to rotate their AWS IAM/STS, HashiCorp Vault, npm publish, and GitHub Actions tokens to mitigate potential exposure. The attack underscores the importance of vigilance in software supply chain security.
This article was produced by NeonPulse.today using human and AI-assisted editorial processes, based on publicly available information. Content may be edited for clarity and style.
