MAL-2023-1227

See a problem?

Import Source

https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lime-web-component-interfaces/MAL-2023-1227.json

JSON Data

https://api.osv.dev/v1/vulns/MAL-2023-1227

Published

2023-03-04T00:00:00Z

Modified

2023-09-05T02:23:23Z

Summary

Malicious code in lime-web-component-interfaces (npm)

Details

-= Per source details. Do not edit below this line.=-

Source: checkmarx (94eb9bf47469857d8b3e3da68a34e320a0c7b1129a7b260fafe36dea5396cc0c)

Malicious packages campaign since 2021 targeting developers, steals source code and secrets

Source: ossf-package-analysis (a6bfa977d2643486a81b788470c6fb71063ec868d37982d1e875a8b4e0bc4e7e)

The OpenSSF Package Analysis project identified 'lime-web-component-interfaces' @ 1.0.1 (npm) as malicious.

It is considered malicious because: - The package communicates with a domain associated with malicious activity. - The package executes one or more commands associated with malicious behavior.

Database specific

{
    "iocs": {
        "ips": [
            "178.128.27.205",
            "185.62.56.25",
            "185.62.57.60",
            "198.199.83.132",
            "5.9.104.19",
            "51.250.2.204",
            "65.21.108.160"
        ],
        "domains": [
            "6wxd3v84nevku06dcgbqcxrmt.canarytokens.com",
            "fhg62xavat9jzyt6euwxi6sro.canarytokens.com",
            "1wy3rk316x8qqy4fyxtvcs4kkbq2es2h.oastify.com",
            "288utkkrohmp0nr8znflcp88nztrhg.oastify.com",
            "bq5m9lnmalh9ktyi9wydockt9kfb32rr.oastify.com",
            "c7kxnys58daceezcxx0jjstn6ec50vok.oastify.com",
            "cczk46g2vtc0000k68dgggx31deyyyyyb.oast.fun",
            "cfrg38n2vtc0000h72xgg8hebweyyyyyb.oast.fun",
            "cfswk0m2vtc0000myvg0g8h6jocyyyyyb.oast.fun",
            "cfytrzv2vtc00002v400geytd6yyyyyyn.oast.fun",
            "ck0r1hp2vtc00007c0zggjocy3ryyyyyb.oast.fun",
            "ho94479k12fy3mdiwjvzvvo09rfh36.oastify.com",
            "l2g8zu5qwvsj5bewhvvxusdpp.canarytokens.com",
            "u3yjt7ui4aa5egu44kdrpys1psvjj97y.oastify.com",
            "u61eou88vswlvti2yihx8ktyrpxfl4.oastify.com",
            "unld4fepiyjq4ywsrj7mmpaz3q9hx9ly.oastify.com",
            "uzx39o3nimx3qp8s14uu6kfjhan1brzg.oastify.com",
            "yhj0choyrutnbvpcjuesxpph58bzztni.oastify.com",
            "cup1qnm56sdo4bdv.b.requestbin.net",
            "4or5o5yn5lqzenk4.b.requestbin.net",
            "bind9-or-callback-server.com",
            "efrva6.dnslog.cn",
            "eozpdddh3tifjo.m.pipedream.net",
            "marcomayo.com",
            "nirobtest.xyz",
            "npmtesttut.com"
        ]
    },
    "malicious-packages-origins": [
        {
            "source": "ossf-package-analysis",
            "import_time": "2023-08-10T06:15:42.519318833Z",
            "modified_time": "2023-05-08T07:46:18.672332972Z",
            "sha256": "a6bfa977d2643486a81b788470c6fb71063ec868d37982d1e875a8b4e0bc4e7e",
            "versions": [
                "1.0.1"
            ]
        },
        {
            "source": "checkmarx",
            "import_time": "2023-09-04T09:11:41.836561767Z",
            "modified_time": "2023-09-01T20:12:58Z",
            "sha256": "94eb9bf47469857d8b3e3da68a34e320a0c7b1129a7b260fafe36dea5396cc0c",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ]
        }
    ]
}

References

https://medium.com/checkmarx-security/an-ongoing-open-source-attack-reveals-roots-dating-back-to-2021-4a511979fd98

Credits

- Checkmarx - FINDER
- - supplychainsecurity@checkmarx.com
  - https://bit.ly/checkmarx-malicious-packages
- OpenSSF: Package Analysis - FINDER
- - https://github.com/ossf/package-analysis
  - https://openssf.slack.com/channels/package_analysis

Affected packages

npm / lime-web-component-interfaces

Package

Name: lime-web-component-interfaces; View open source insights on deps.dev
Purl: pkg:npm/lime-web-component-interfaces

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Affected versions

1.*

1.0.1

Database specific

source

"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/lime-web-component-interfaces/MAL-2023-1227.json"