蠕虫 npm 包和代币窃取者：深入探讨供应链安全

最近发生的涉及蠕虫 npm 软件包和代币窃取者的事件凸显了软件供应链面临的日益增长的风险。亚马逊研究人员发现了大规模的代币挖矿活动，强调了强有力的安全措施的必要性。

Wormable npm Packages and Token Stealers: A Deep Dive into Supply Chain Security

蠕虫 npm 包和代币窃取者：深入探讨供应链安全

The npm registry, a cornerstone of JavaScript development, has recently been under siege. From self-replicating worms to sophisticated token-stealing schemes, the threat landscape is evolving rapidly. This article delves into recent discoveries and trends surrounding these attacks, focusing on the risks and potential mitigations.

作为 JavaScript 开发基石的 npm 注册表最近受到了围攻。从自我复制蠕虫到复杂的令牌窃取方案，威胁形势正在迅速演变。本文深入研究了围绕这些攻击的最新发现和趋势，重点关注风险和潜在的缓解措施。

The Rise of Malicious npm Packages

恶意 npm 包的兴起

Recent findings from Amazon researchers have shed light on a significant issue: over 150,000 malicious packages lurking within the npm registry. These packages were part of a "token farming" campaign targeting the tea.xyz protocol, a system designed to reward open-source developers. This campaign showcases how attackers are increasingly weaponizing npm packages to compromise developers and execute supply chain attacks.

亚马逊研究人员的最新发现揭示了一个重大问题：npm 注册表中潜伏着超过 150,000 个恶意软件包。这些软件包是针对 tea.xyz 协议的“代币耕作”活动的一部分，该协议是一个旨在奖励开源开发人员的系统。此活动展示了攻击者如何越来越多地利用 npm 软件包来危害开发人员并执行供应链攻击。

Unlike traditional malware-laden packages, this token farming campaign didn't rely on overtly malicious code. Instead, it exploited the tea.xyz reward mechanism by artificially inflating package metrics through automated replication and dependency chains. This allowed threat actors to extract financial benefits from the open-source community.

与传统的恶意软件包不同，这种代币挖矿活动并不依赖于明显的恶意代码。相反，它通过自动复制和依赖链人为地夸大包指标，从而利用了 tea.xyz 奖励机制。这使得威胁行为者能够从开源社区获取经济利益。

How the Attack Works

攻击如何进行

The attackers utilized automated tooling to self-replicate malicious packages at an unprecedented scale. They exploited npm's package installation mechanisms to create self-replicating systems. The package.json file, which contains executable scripts and dependency lists, was weaponized to create circular dependency chains. Installing one malicious package would automatically trigger the installation of multiple additional packages, maximizing both the installation cascade and the tea.xyz teaRank scoring.

攻击者利用自动化工具以前所未有的规模自我复制恶意软件包。他们利用 npm 的包安装机制来创建自我复制系统。 package.json 文件包含可执行脚本和依赖项列表，已被武器化以创建循环依赖项链。安装一个恶意软件包将自动触发安装多个附加软件包，从而最大化安装级联和 tea.xyz teaRank 评分。

The Impact

影响

Even though these packages didn't contain ransomware or information stealers, they still posed significant risks. These risks included:

尽管这些软件包不包含勒索软件或信息窃取程序，但它们仍然构成重大风险。这些风险包括：

• Polluting the npm registry with non-functional packages
• Taxing the registry's bandwidth, storage, and infrastructure resources
• Dependency confusion and other supply chain risks

Wormhole and Cross-Chain DeFi

虫洞与跨链 DeFi

On a somewhat related note, the broader DeFi landscape is also seeing advancements in interoperability. Folks Finance, for example, has integrated Wormhole’s Native Token Transfers (NTT) to broaden its governance token, FOLKS, across multiple blockchain networks. This initiative enhances cross-network interaction and eliminates the need for wrapped tokens, reducing risks associated with synthetic assets.

与此相关的是，更广泛的 DeFi 领域也在互操作性方面取得了进步。例如，Folks Finance 集成了 Wormhole 的原生代币转移 (NTT)，以将其治理代币 FOLKS 扩展到多个区块链网络。这一举措增强了跨网络交互，消除了对包装代币的需求，从而降低了与合成资产相关的风险。

Mitigation Strategies

缓解策略

To combat these threats, organizations should take proactive steps:

为了应对这些威胁，组织应采取主动措施：

• Use Amazon Inspector: Detect packages tied to the token farming campaign and audit existing npm packages.
• Enforce Software Bills of Materials (SBOMs): Maintain a comprehensive list of software components.
• Isolate CI/CD Environments: Protect continuous integration and continuous delivery pipelines.

Looking Ahead

展望未来

The incidents discussed above underscore the importance of vigilance and proactive security measures. The software supply chain is a complex ecosystem, and securing it requires a multi-faceted approach. By staying informed and implementing robust security practices, we can collectively mitigate the risks posed by malicious actors.

上述事件强调了保持警惕和主动采取安全措施的重要性。软件供应链是一个复杂的生态系统，确保其安全需要采取多方面的方法。通过及时了解情况并实施强大的安全实践，我们可以共同减轻恶意行为者带来的风险。

So, keep those dependencies in check, and remember: a little paranoia goes a long way in the wild world of npm!

因此，请控制住这些依赖关系，并记住：一点偏执在 npm 的狂野世界中大有帮助！