DirtyBlanket: Fake Express Packages on npm Spread a Linux Worm
Summary
SafeDep analyzes a nine package npm campaign by the dirtyblanket actor that hides a Linux worm in Express/React packages. The attack chain uses a preinstall hook to fetch a loader via the Wayback Machine, downloads a Linux worm, installs a backdoor named systemd-fontd, and propagates through SSH keys, Arch AUR, and npm tokens. The post includes IOC details, binary analysis, and extensive indicators to watch for in software supply chains.