Slaying the Dragons: A Security Professional's Guide to Burnout and Resilience

Slaying the Dragons: A Security Professional's Guide to Malicious Packages

Speaker: Kirill Boychenko

Conference: BSidesSF 2025 — April 26-27, 2025, San Francisco

YouTube: Watch on YouTube

Reading time: ~8 minutes

TL;DR

Modern software applications are 70–90% open-source by composition, making package ecosystems an irresistible attack surface. Kirill Boychenko, senior threat intelligence analyst at Socket, walked through real malicious campaigns targeting npm, PyPI, Go, Java/Maven, and RubyGems — demonstrating how attackers combine typosquatting, obfuscation, AI-assisted code generation, multi-stage payloads, and legitimate services like Gmail and Discord to compromise developers and drain crypto wallets. The defense requires automated, behavioral scanning at scale — manual review of millions of packages is not a viable option.

Introduction

The average software application today contains 70 to 90 percent open-source code. GitHub has over 100 million users. The npm ecosystem and PyPI alone account for millions of packages and billions of downloads. These numbers represent an enormous amount of shared, reusable value — and an equally enormous attack surface.

Kirill Boychenko, a senior threat intelligence analyst at Socket, used his BSidesSF 2025 talk to walk through what his team sees on a daily basis as they monitor open-source ecosystems for malicious activity. The picture is sobering: attackers are not waiting for zero-days in popular frameworks. They are quietly publishing malicious packages with nearly identical names, embedding backdoors in clones of legitimate libraries, and using tools like ChatGPT to industrialize the process.

The talk is grounded in specific, recently discovered campaigns across multiple ecosystems — not theoretical threat models. Each example illustrates a recurring set of techniques that, when recognized, become detectable signals.

The Attack Surface: Why Package Ecosystems Are So Vulnerable

▶ Watch: Open source attack surface overview (02:00)

The core tension Boychenko identified is that the same properties that make open-source ecosystems valuable also make them exploitable: low barriers to publishing, automatic trust in registered packages, and the practical impossibility of manually reviewing every dependency.

Publishing a new package to npm or PyPI is designed to be easy — that accessibility fuels innovation. But it also means a threat actor with a GitHub account and a few minutes can introduce a malicious package into an ecosystem used by millions of developers. The Go module mirror, npm's registry, PyPI, RubyGems, Maven Central, and NuGet all face this challenge at different scales.

Boychenko summarized the primary attack techniques his team tracks:

• Code repository abuse — exploiting how ecosystems cache and proxy packages from source repositories
• Typosquatting — creating deceptively similar package names to capture installation errors
• Obfuscation — making malicious code harder to detect by static analysis
• Multi-stage malware — separating first-stage dropper from second-stage payload to evade detection and enable payload swaps
• Automation and AI — using tools including ChatGPT to generate, obfuscate, and mass-publish malicious packages
• Legitimate services for C2 and exfiltration — routing stolen data through Gmail, Discord, Sentry, and even Ethereum smart contracts

Case Study 1: The Go Module Mirror Abuse

▶ Watch: Go ecosystem attack — BoltDB clone (08:01)

The first example Boychenko presented came from the Go ecosystem and illustrated how attackers can abuse infrastructure built for convenience. In 2021, a threat actor published a GitHub repository that cloned BoltDB — a widely used Go embedded database library — adding a few characters to the name (typosquatting). At that point, the Go module mirror cached the malicious package, because the mirror is designed to cache packages it encounters as part of normal proxy behavior.

The attacker then cleaned up their GitHub repository, pointing it back to the legitimate BoltDB codebase. Anyone manually inspecting the GitHub repo would find nothing wrong. But the Go module mirror had already cached the malicious version — so anyone pulling the package through the official proxy would receive the backdoored code.

The obfuscation technique inside the malicious package was straightforward but effective: two files worked together to assemble a C2 address at runtime. One file (cursor.go) contained what appeared to be random numbers. Programmatically, fives became dots and sixes and sevens were removed — reconstructing an IP address and port number for the backdoor's command-and-control server. Simple enough to bypass signature-based scanners that look for hardcoded IPs.

Case Study 2: AI-Assisted Typosquatting at Scale in npm

▶ Watch: npm ecosystem — ChatGPT-assisted typosquatting (16:02)

Towards the end of October 2024, Socket's AI scanner detected a rapid surge of new npm packages being published in quick succession. The packages were malicious, but what made this campaign distinctive was its C2 mechanism: the threat actor used Ethereum smart contracts as the command-and-control channel.

This approach made the C2 difficult to block through conventional means. Security teams know how to block suspicious IPs and domains — that is well-practiced. Blocking interactions with Ethereum's blockchain is another matter entirely. The decentralized nature of the smart contract also allowed the attacker to update the payload without changing the package or its infrastructure. The campaign targeted Windows, Linux, and macOS.

When Socket researchers found the threat actor advertising their techniques on dark web forums — complete with screenshots, videos, and written tutorials — they discovered how the typosquatting component was generated: the attacker had simply asked ChatGPT to produce typo variants of popular npm packages like express. ChatGPT obligingly produced a long list of near-miss names; the attacker registered the ones not yet taken and published malicious packages to those names. "You provide it with Express and just say, 'Give me typosquatted versions of it.'"

The campaign published approximately 280 packages in a very short time window using automated mass-publishing tools. Alongside typosquatting package names, the attacker also typosquatted the identity of a prolific npm maintainer — CinderSource — using the same profile image and publishing a package called chalk-node (a typosquat of the widely used chalk terminal-coloring library). That package included an info-stealer in index.esm.js that accessed and exfiltrated sensitive files from victim systems.

Case Study 3: North Korean "Contagious Interview" Campaign

▶ Watch: Multi-stage payload — North Korea's Contagious Interview (22:03)

Socket consistently identifies North Korean state-sponsored actors infiltrating the npm ecosystem as part of an ongoing operation Boychenko referred to as Contagious Interview — targeting developers under the pretext of technical interviews or job application tests. The malicious packages in these campaigns deploy a multi-stage payload.

Stage one is a combined info-stealer and malware loader. It steals sensitive data from browser storage (Chrome, Brave, Firefox), harvests Solana wallet credentials, and extracts macOS Keychain credentials. Stage two downloads the InvisibleFerret backdoor, which installs itself for persistence, renames its own binary to evade detection, and adds further malicious capabilities.

Obfuscation in this campaign relied on a popular JavaScript obfuscation tool — the kind that produces a single, extremely long obfuscated line. Boychenko noted that multiple free de-obfuscators exist for this specific tool, making it possible to analyze the code despite the obfuscation. The threat actors also used AI to help generate the malicious JavaScript, with AI-characteristic commenting visible in the de-obfuscated code.

Case Study 4: Gmail Exfiltration and Cross-Ecosystem Threats

▶ Watch: Gmail exfiltration and legitimate services abuse (26:04)

A separate npm campaign Boychenko presented targeted Solana private keys, with a twist: the threat actor used Gmail as the exfiltration channel, hard-coding both Gmail addresses and their passwords directly in the package. The logic is not entirely irrational from an attacker's perspective — SMTP traffic may be unremarkable in many environments, and Gmail domains are not blocked the way suspicious C2 infrastructure might be.

A follow-on campaign in the same lineage went further: after exfiltrating credentials via Gmail, the malware would transfer 98 percent of the victim's Solana wallet balance to the attacker's address, leaving 2 percent (presumably for transaction fees).

In the Java/Maven Central ecosystem, Boychenko presented a case where attackers cloned the popular XC4J library, embedded backdoor code, and used AI-generated obfuscation to make the malicious additions less obvious. The pattern of publishing a benign version first and then introducing malicious functionality in a subsequent release was also present here — a technique designed to pass any scrutiny of the initial release before the actual attack payload is deployed.

A PyPI example showed an attacker adding a single letter "S" to browsercookie3 to create a convincing typosquat that included an unexplained binary, client.exe. Decompilation revealed modules for screenshotting the victim's screen, stealing passwords, accessing the device camera, and exfiltrating all of it to a Discord webhook.

Defenses: What Developers and Security Teams Can Do

▶ Watch: Defense strategies and threat hunting signals (36:05)

Boychenko was candid that manual vetting of every dependency is impossible at current scales — millions of packages, billions of downloads, continuous updates. The defense posture therefore must be automated and behavioral.

Key threat hunting signals to watch for:

• Post-install scripts that run automatically on package installation (especially in npm)
• Obfuscation as a signal — not proof of malice, but a meaningful indicator, especially in combination with other flags
• Unexplained network calls to endpoints that have no documented purpose in the package
• Dropped executables with no description or clear function
• Newly published packages from new authors with no history, especially ones whose names closely resemble popular packages

For organizational defenses, Boychenko emphasized the need for tooling that can scan packages at ingestion time, maintain an approved package registry, and block packages identified as malicious before they reach a developer's build environment. Socket's own approach uses more than 70 behavioral indicators to verdict packages, with all methodology published openly on their website.

On the ecosystem side, Boychenko reported that PyPI and the Go module mirror have responsive security teams that act on takedown requests promptly. npm, by contrast, is slower — a gap the community noted in Q&A. He also confirmed that dependency confusion — where an attacker registers a public package matching an internal package name, hoping automated tooling fetches the public malicious version — remains an active threat: Socket found evidence of the BlackBuster ransomware group actively testing this technique.

Notable Quotes

"From seventy to ninety percent open source in a software application is a lot. The bad guys know that too — they understand how we're assembling applications and are trying to use it to their advantage." — Kirill Boychenko (02:00)

"They just asked ChatGPT to create typo variants of the most popular packages. And so they created a long list of typo variants and registered the ones that weren't yet taken." — Kirill Boychenko (18:03)

"There is no way that we can vet all of those dependencies and libraries manually. There's just too many of them. We need to be able to scan the code, vet it, approve it." — Kirill Boychenko (36:05)

Key Takeaways

• Software supply chain attacks via open-source packages are a daily operational reality, not a theoretical risk. Attackers are actively publishing malicious packages across npm, PyPI, Go, Maven, RubyGems, and NuGet.
• Typosquatting is ubiquitous and increasingly AI-assisted. ChatGPT can generate exhaustive lists of plausible typo variants in seconds; attackers have operationalized this.
• Legitimate services — Gmail, Discord, Ethereum smart contracts, Sentry — are being used for C2 and exfiltration precisely because they blend into normal traffic and are difficult to block.
• Multi-stage payloads extend attacker persistence and evade detection by separating the initial dropper from the final payload and enabling payload swaps after installation.
• Obfuscation is a signal, not proof. Combined with unexplained network calls, post-install scripts, or dropped executables, it becomes a high-confidence indicator of malice.
• Automated behavioral scanning is the only viable defense at scale. Approved package registries, dependency pinning, and behavioral analysis tools must be part of every development pipeline.