Persistent npm Campaign Shipping Trojanized jQuery
Essential information
- Published
- 10/07/2024 09:36
- Modified
- 10/07/2024 10:02
- Tags
- 2024-07-10 exfiltration github malware npm supply-chain
- Related entities
- 67 observables, 6 techniques (mitre)
Description
The report describes a persistent supply chain attack involving the distribution of a trojanized version of jQuery through various platforms like npm and GitHub. The malicious jQuery variant, containing a modified 'end' function, exfiltrates website form data by sending it to remote URLs controlled by the attackers. The attack stands out due to its high variability across packages, including unique exfiltration URLs and usernames, as well as the inclusion of personal files in the published packages. This suggests a manual approach rather than an automated one. The report highlights the potential for widespread impact and demonstrates the increasing complexity of supply chain threats.