Threat video1:00
TOPHIT 85-Package npm Typosquat Flood: Detection & IOCs
One npm account pushed 85 @prime0 typosquats in minutes; its host also runs a GPU harvester. 9 detection rules, 13 IOCs and a free Splunk SPL rule.
Read the full threat intel for TOPHIT 85-Package npm Typosquat Flood: Detection & IOCs →
Chapters
- 0:00The hookOne npm account published about 85 typosquats.
- 0:04The storyNames misspell popular libraries, like chalk.
- 0:11Attack pathPer CloudSEK, the generator makes lookalike names.
- 0:28AttributionNo threat actor is attributed.
- 0:32Indicators of compromise10 indicators to hunt: 1 IP, 1 IP range and 3 URLs, and more.
- 0:39MITRE ATT&CK techniques13 ATT&CK techniques, from reconnaissance to command and control.
- 0:44Remediation10 remediation steps are listed, 4 of them immediate.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00One npm account published about 85 typosquats.
0:05Names misspell popular libraries, like chalk.
0:08Editor autocomplete can surface them first.
0:11Per CloudSEK, the generator makes lookalike names.
0:15Then 85 packages flood npm.
0:18Installing one sends a fingerprint.
0:20Then it polls for commands repeatedly.
0:23The same server's panel enumerates GPU hosts.
0:28No threat actor is attributed. Confidence: low.
0:3310 indicators to hunt: 1 IP, 1 IP range and 3 URLs, and more.
0:3913 ATT&CK techniques, from reconnaissance to command and control.
0:4410 remediation steps are listed, 4 of them immediate.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.