Detection Evasion Tactics Employed by Malicious NPM Package Through Unicode Steganography

vue-bit, which are presented as accessibility and developer platform engineering tools.

The promotional tactics employed by the threat actor for these packages remain ambiguous.

Unicode Steganography Explained

Within the malicious version, the perpetrator concealed data within a seemingly innocuous ‘|’ string, which is succeeded by a protracted sequence of invisible Unicode characters sourced from the Variation Selectors Supplement range (U+E0100 to U+E01EF).

These Unicode characters, typically modifiers employed to furnish specific glyph variations in complex scripts, were exploitatively utilized for text-based steganography, adeptly concealing information within other data.

Upon decoding and deobfuscating the string, Veracode unearthed a payload entailing a complex C2 mechanism reliant on a Google Calendar short link directing towards the ultimate payload.

Researchers elucidated that following the retrieval of the Google Calendar link, a series of redirects are assessed until an HTTP 200 OK response is obtained. Subsequently, a data-base-title attribute is extracted from the event’s HTML page, containing a base64-encoded URL that leads to the final payload.

The URL is processed via a function termed ymmogvj, enabling the extraction of the malicious payload. Notably, the response body is anticipated to encapsulate a base-encoded stage-2 malware payload, likely accompanied by an initialization vector and a secret key within the HTTP headers, indicating potential encryption of the final payload.

Additionally, Veracode’s findings indicate that the execution of the payload utilizes the eval(). method. The script implements a simplistic persistence mechanism within the system’s temporary directory, ensuring that multiple instances of the malware do not operate concurrently.

As of the time of analysis, researchers were unable to retrieve the final payload, suggesting that the threat campaign might be suspended or in preliminary stages.

Despite Veracode’s notification of these findings to NPM, the questionable packages remain available on the platform.