Rogue NuGet Packages Infect .NET Developers with Crypto-Stealing Malware

Mar 22, 2023Ravie LakshmananDevOpsSec / Malware

The NuGet repository is the target of a new “sophisticated and highly-malicious attack” aiming to infect .NET developer systems with cryptocurrency stealer malware.

The 13 rogue packages, which were downloaded more than 160,000 times over the past month, have since been taken down.

“The packages contained a PowerShell script that would execute upon installation and trigger a download of a ‘second stage’ payload, which could be remotely executed,” JFrog researchers Natan Nehorai and Brian Moussalli said.

While NuGet packages have been in the past found to contain vulnerabilities and be abused to propagate phishing links, the development marks the first-ever discovery of packages with malicious code.

Three of the most downloaded packages – Coinbase.Core, Anarchy.Wrapper.Net, and DiscordRichPresence.API – alone accounted for 166,000 downloads, although it’s also possible that the threat actors artificially inflated the download counts using bots to make them appear more legitimate.

The use of Coinbase and Discord underscores the continued reliance on typosquatting techniques, in which fake packages are assigned names that are similar to legitimate packages, in order to trick developers into downloading them.

The malware incorporated within the software packages functions as a dropper script and is designed to automatically run a PowerShell code that retrieves a follow-on binary from a hard-coded server.

As an added obfuscation mechanism, some packages did not embed a malicious payload directly, instead fetching it via another booby-trapped package as a dependency.

Even more troublingly, the connection to the command-and-control (C2) server occurs over HTTP (as opposed to HTTPS), rendering it vulnerable to an adversary-in-the-middle (AiTM) attack.

The second-stage malware is what JFrog describes as a “completely custom executable payload” that can be dynamically switched at will since it’s retrieved from the C2 server.

The second-stage delivers several capabilities that include a crypto stealer and an auto-updater module that pings the C2 server for an updated version of the malware.

The findings come as the software supply chain has become an increasingly lucrative pathway to compromise developers’ systems and stealthily propagate backdoored code to downstream users.

“This proves that no open source repository is safe from malicious actors,” Shachar Menashe, senior director at JFrog Security Research, said in a statement shared with The Hacker News.

“.NET developers using NuGet are still at high risk of malicious code infecting their environments and should take caution when curating open-source components for use in their builds – and at every step of the software development lifecycle – to ensure the software supply chain remains secure.”