Sabotage: Code added to popular NPM package wiped files in Russia and Belarus

Sabotage: Code added to popular NPM package wiped files in Russia and Belarus

Getty Images

The developer of a popular open source package has been caught adding malicious code to that package, which wiped files from computers located in Russia and Belarus, in a protest that has enraged many users and raised concerns about the safety of free and open source software.

The application, node.ipc, adds remote Inter Process Communication and neural networking capabilities to other open source code libraries. As a dependency, node.ipc is automatically downloaded and incorporated into other libraries, including ones like Vue.js CLI, which has more than 1 million weekly downloads.

A deliberate and dangerous act

Two weeks ago, the node.ipc author pushed a new version of the library that sabotaged computers located in Russia and Belarus, the countries invading Ukraine and providing support for the invasion, respectively. The new release added a function that checked the IP address of developers who used the node.ipc in their own projects. When an IP address geolocated to either Russia or Belarus, the new version wiped files from the machine and replaced it with a heart emoji.

To conceal the malice, node.ipc author Brandon Nozaki Miller base-64-encoded the changes to make things harder for users who wanted to visually inspect them to check for problems. What those developers saw was:

+      const n2 = Buffer.from("Li8=", "base64");
+      const o2 = Buffer.from("Li4v", "base64");
+      const r = Buffer.from("Li4vLi4v", "base64");
+      const f = Buffer.from("Lw==", "base64");
+      const c = Buffer.from("Y291bnRyeV9uYW1l", "base64");
+      const e = Buffer.from("cnVzc2lh", "base64");
+      const i = Buffer.from("YmVsYXJ1cw==", "base64");

These lines were then passed to the timer function, such as:

+          h(n2.toString("utf8"));

The values ​​for the Base64 strings were:

  • n2 is set to: ./
  • o2 is set to: ../
  • r is set to: ../../
  • f is set to: /

When passed to the timer function, the lines were then used as inputs to wipe files and replace them with the heart emoji.

+      try {
+        import_fs3.default.writeFile(i, c.toString("utf8"), function() {
+        });

“At this point, a very clear abuse and a critical supply chain security incident will occur for any system on which this npm package will be called upon, if that matches a geo-location of either Russia or Belarus,” wrote Liran Tal, a researcher at Snyk, a security company that tracked the changes and published its findings on Wednesday.

Such found that the node.ipc author maintains 40 other libraries, with some or all of them also being dependencies for other open source packages. Referring to the node.ipc author’s handle, Such questioned the wisdom of the protest and its likely fallout on the open source ecosystem as a whole.

“Even if the deliberate and dangerous act of maintainer RIA Evangelist will be perceived by some as a legitimate act of protest, how does that reflect on the maintainer’s future reputation and stake in the developer community? Would this maintainer ever be trusted again to not follow up on future acts in such or even more aggressive actions for any projects they participate in?”

gone forever

RIA Evangelist also came under fire on Twitter and in open source forums. The new malicious code release, one person claiming to work for a US-based organization that operated a server in Belarus wrote“resulting in executing your code and wiping over 30,000 messages and files detailing war crimes committed in Ukraine by Russian army and government officials.”

The person, who later took down the post and republished it here, said that the purpose of the Belarussian server was to bypass censorship in that country. The organization’s personnel had already been stretched thin since Russia began its invasion of Ukraine on February 24, the person said, and for reasons that aren’t clear, messages from front-line soldiers and other sensitive data was likely gone forever.

“Personally, me and my colleagues are absolutely devastated,” the person wrote. “All I can say [is] that your little shenanigan did more damage to us than Putin or Lukashenka ever could. Professionally, our counsel suggested filing criminal charges federally and it’s likely we’ll be proceeding this way.”

Leave a Reply

Your email address will not be published.