Over 1200 NPM Packages Found Involved in “CuteBoi” Cryptomining Campaign

Products You May Like

Researchers have disclosed a new large-scale cryptocurrency mining campaign targeting the NPM JavaScript package repository.

The malicious activity, attributed to a software supply chain threat actor dubbed CuteBoi, involves an array of 1,283 rogue modules that were published in an automated fashion from over 1,000 different user accounts.

“This was done using automation which includes the ability to pass the NPM 2FA challenge,” Israeli application security testing company Checkmarx said. “This cluster of packages seems to be a part of an attacker experimenting at this point.”

All the released packages in question are said to harbor near-identical source code from an already existing package named eazyminer that’s used to mine Monero by means of utilizing unused resources on web servers.

One notable modification entails the URL to which the mined cryptocurrency should be sent, although installing the rogue modules will not bring about a negative effect.

Cryptomining Campaign

“The copied code from eazyminer includes a miner functionality intended to be triggered from within another program and not as a standalone tool,” researcher Aviad Gershon said. “The attacker didn’t change this feature of the code and for that reason, it won’t run upon installation.”

Like observed in the case of RED-LILI earlier this year, the packages are published via an automation technique that allows the threat actor to defeat two-factor authentication (2FA) protections.

Cryptomining Campaign

However, while the former involved setting up a custom server and using a combination of tools like Selenium and Interactsh to programmatically create an NPM user account and defeat 2FA, CuteBoi relies on a disposable email service called mail.tm.


The free platform also offers a REST API, “enabling programs to open disposable mailboxes and read the received emails sent to them with a simple API call,” allowing the threat actor to circumvent the 2FA challenge when creating a user account.

The findings coincide with another NPM-related widespread software supply chain attack dubbed IconBurst that’s engineered to harvest sensitive data from forms embedded in downstream mobile applications and websites.

Cyber Security

Products You May Like

Articles You May Like

Microsoft Joins ONDC, to Launch Shopping App in India: All the Details
Twitter Revives Misinformation Rules, Features Ahead of US Midterm Elections
Rocket Debris From Space Launches Have 10 Percent Chance of Injuring Humans by Next Decade, Claims Study
Spotify Rolls Out Redesigned Home With Separate Music, Podcast Feeds on Android: All Details
Government Said to Seek Ouster of Chinese Firms From Affordable Smartphone Market

Leave a Reply

Your email address will not be published.