Global security desk · updated coverage of threats, exploits & breaches
Twitter Sitemap
Circular security news icon in navy and blue tones with a shield-like mark SecNews24.com Read Latest News

Malicious npm package found to contain cryptominer and backdoor

Researchers examining the 2018 npm supply-chain compromise found a modified package able to install a cryptocurrency miner and a remote-control backdoor. The affected chain centred on the widely used event-stream package and a malicious flatmap-stream dependency, showing how trusted registry access can become a route into thousands of development environments. Its importance lies in the route into those systems, rather than in the sophistication of either payload.

For Australian organisations, the episode remains a practical warning. Sydney and Melbourne are major centres for fintech, software and consulting work, while Brisbane and Perth support government, resources and field-service teams whose developers routinely combine open-source components with cloud services. Hybrid offices also spread support across AEST and AEDT, so an overnight compromise may remain unactioned until local staff arrive. A seemingly routine npm install can connect a local workstation to production credentials, customer systems and Australian-hosted workloads.

The miner and backdoor also need different responses. Mining turns authorised compute into unauthorised revenue and can inflate cloud bills. A backdoor can steal secrets, open a command channel or download another payload. When both operate from the same package, a team that spots only unusual processor load might still miss persistent access and data theft.

Inside the package’s dual payload

The attack exploited npm’s dependency model and a change in control around the event-stream project. A malicious update to flatmap-stream was pulled in as a transitive dependency, meaning users who never requested that package name could execute attacker-selected code during installation or first use. npm lifecycle scripts can run with the developer’s account before the application is reviewed, while imported modules can execute code when another package invokes them. This distinction matters: reviewing only the package named in package.json would not reveal the full execution path.

The cryptominer component used the infected machine’s processing capacity to mine cryptocurrency, typically by joining a mining pool through outbound network traffic. Its installer could conceal its activity among legitimate package setup, adjust intensity when monitoring was present, or leave the miner running after the original npm command finished. The immediate symptom was sustained CPU use, but financial loss occurred only if the miner remained active on paid infrastructure.

The backdoor served a more strategic purpose. It could collect environment variables, SSH material, npm tokens, cloud credentials and files from cryptocurrency wallet or configuration directories before communicating with attacker infrastructure. One recorded indicator was the reported malware domain, which should be retained for retrospective searches and blocked where appropriate. Mining concealed the compromise, while the backdoor gave the attacker control after the first infection.

Why npm changes the blast radius

npm projects often contain many direct and indirect dependencies, and build tooling may run automatically before an application reaches production. A compromised maintainer account, malicious update or dependency-confusion package can therefore reach continuous-integration workers, developer laptops and servers through a familiar installation command. Registry reputation does not guarantee that every new release behaves like the version reviewed months earlier.

Australian market conditions add operational detail without changing the technical risk. Fintech and SaaS firms around Sydney and Melbourne may ship JavaScript services consumed nationwide, while resource businesses in Perth and Brisbane operate systems linked to remote sites and third-party contractors. An Australian developer can publish a dependency used far beyond its home market, and a malicious update can return through the same global supply chain to local teams.

Cloud availability sharpens that exposure. Major providers maintain Australian regions in Sydney and Melbourne, and many organisations run build agents or container workloads there. Excessive CPU from mining can appear as an ordinary scale-out event, while an over-privileged CI role can turn stolen cloud tokens into deployment access. If personal or customer data leaves the environment, the Privacy Act 1988, OAIC’s notifiable data breach scheme and sector rules such as APRA’s standards may shape the required response.

Detecting the compromise in development and cloud

Triage should begin with package provenance. Investigators should compare the installed release with a known-good source, inspect changes to package.json and lifecycle scripts, and review the full dependency tree rather than the top-level name alone. npm audit and software-composition tools can identify known advisories and suspicious scripts, but a newly weaponised release might not yet have a recorded advisory. Lockfiles, registry metadata, publisher history and release timestamps provide valuable context.

Host evidence then shows what actually ran. Endpoint telemetry can reveal a miner binary, spawned shells, PowerShell or child-process activity, and reads of credential directories. Network logs may expose mining-pool domains, unusual DNS queries or long-lived outbound sessions. Correlation matters: npm frequently reaches registry endpoints and content-delivery networks, so a destination becomes meaningful when paired with process ancestry, package-install timing and repeated beaconing. On a shared build worker, that package-to-process relationship can separate hostile activity from the workload’s normal compiler and test traffic.

Looking back through the October 2018 security archive places the compromise in a period when registry trust was already under pressure. A defensible response preserves package manifests, lockfiles, npm logs, cache contents and affected host images before they are rebuilt. It also records package names, versions, integrity hashes and timestamps, allowing teams to distinguish a removed dependency from one still present in a cached or prebuilt artefact.

Command-and-control and covert exfiltration

Malware often mixes ordinary web traffic with covert channels because the second can survive a suspicious HTTP request being blocked. A SecNews24 analysis of DNS tunneling malware shows how commands or stolen data can be encoded into DNS queries. The traffic can look like routine name resolution unless defenders examine query length, repetition, subdomain structure and response sizes.

Useful detections include bursts of unique subdomain labels, TXT or CNAME responses carrying unusual data, periodic requests to a newly registered domain, and the same endpoint resolving unrelated hostnames. These patterns require baselines because some legitimate services use dynamic DNS or encrypted DNS. Endpoint-to-DNS correlation is particularly valuable: a package install followed by regular strange lookups is stronger evidence than strange traffic alone. DNS over HTTPS can conceal query names from local resolvers, so endpoint inspection and authoritative DNS telemetry remain important.

Containment should remove the causal package before addressing every downstream symptom. Isolate affected systems, block confirmed infrastructure, revoke exposed tokens and inspect persistence locations, then rebuild from trusted artefacts. Australian organisations can coordinate with the Australian Signals Directorate’s Australian Cyber Security Centre and the Joint Cyber Security Centre when the incident is significant or spans multiple entities. Early notification also preserves options where legal reporting clocks apply.

Response priorities for Australian organisations

A suspected npm compromise needs an ordered response that separates immediate containment from longer-term control. Teams working in Sydney, Melbourne or distributed Australian offices should use the same evidence standard and avoid making irreversible cleanup decisions from an unverified chat message. The first list below addresses active risk.

Recovery should then remove the malicious code path and reduce the chance that another trusted account carries it inward. Teams should treat package installation as privileged code execution, not routine file downloading. The second list turns that principle into durable controls.

Area Expected dependency behaviour Signs of the compromise Verification
Lifecycle Any script is visible and necessary for the stated function Obfuscated code, hidden downloads, unexplained child processes Diff published source and inspect preinstall, install and postinstall hooks
Network Requests match documented APIs and services Mining pools, unfamiliar C2 hosts, encoded DNS queries Review DNS, proxy and endpoint telemetry against package activity
Credentials The package reads only configuration it needs Access to .ssh, browser data, tokens, cloud metadata or wallet files Scope service accounts and rotate secrets after isolation
Provenance Publisher and release history are stable and traceable Account takeover, sudden maintainer change or unexplained dependency Verify maintainers, lockfile hashes, signatures and release diffs

Taken together, the event-stream chain shows why cryptomining and backdoor activity should be investigated as one compromise. Cleaning a miner without removing stolen credentials leaves the intruder’s access intact; rebuilding a server without identifying the poisoned dependency allows recurrence. For Australian boards, dependency provenance, cloud identity and incident reporting should sit within the same cyber-risk framework, alongside the operational realities of globally consumed software and nationally hosted infrastructure.