The Cyber Defense eMagazine November Edition for 2023

packages. The idea is to obstruct risky or malicious components at the point of request or update so they
don’t infiltrate the software ecosystem.
Rising Threat: Software Package Hijacking
Software package hijacking is a rising and significant cybersecurity threat where legitimate software
packages are injected with malicious code. Although challenging to execute, the method is highly
effective due to the widespread use of these packages, creating a high infection rate. Once a package
hijacking incident is identified, package maintainers or public repository administrators work to remove
the malicious version and publish a clean one, making the infected version inaccessible.
There are two main types of software package hijacking:
1. External Package Hijacking. Software package hijacking is typically carried out using unauthorized
access to maintainers' and developers' accounts or by discreetly injecting hidden malicious code into
legitimate code contributions to open-source projects. A relatively recent example of this was seen in the
PyTorch library, a renowned Python machine-learning framework with more than 180 million downloads.
In December 2022, PyTorch experienced a dependency hijacking attack directly targeting the machine
learning (ML) developer community. The attacker successfully acquired PyTorch maintainer credentials
and introduced a malicious dependency named "torchtriton" into the project. The malicious package
garnered more than 3,000 downloads within just five days.
The payload concealed within torchtriton exfiltrated sensitive information, including Secure Shell (SSH)
keys and environment variables, sending them to the attacker's server.
2. Self-Package Hijacking (Protestware). Software package hijacking isn't limited to external malicious
actors; developers and project maintainers themselves sometimes engage in this activity as a form of
protest or advocacy for their beliefs. This form of hijacking, often referred to as "protestware," is a
concerning trend because it can be difficult for an organization to recognize it before it's too late.
Take, for instance, "faker" and "colors," two npm packages highly favored by Node.js developers. The
“colors” package enables developers to apply styles, fonts, and colors to the Node.js console, while
“faker” aids in generating data for testing purposes during development.
The same individual authored both packages which became quite popular, rising to millions of weekly
downloads. In January 2022, the author intentionally sabotaged the packages to protest against large
corporations that didn't contribute to the open-source community. They sabotaged both packages by
injecting an infinite loop into the code, effectively rendering thousands of projects that depended on these
packages inoperable. It took two days to detect this malicious modification following the release of the
tainted versions.
Cyber Defense eMagazine – November 2023 Edition 74
Copyright © 2023, Cyber Defense Magazine. All rights reserved worldwide.