Threat Actors Weaponizing Open Source Packages to Deliver Malware in Supply Chain Attack

In the first half of 2025, cybersecurity experts have observed a significant rise in threat actors targeting the software supply chain through weaponized open source packages. These attacks leverage the implicit trust developers place in third-party dependencies, transforming seemingly benign libraries into vehicles for delivering sophisticated malware like infostealers, remote shells, and cryptocurrency drainers. Modern […] The post Threat Actors Weaponizing Open Source Packages to Deliver Malware in Supply Chain Attack appeared first on Cyber Security News.

May 16, 2025 - 05:46

Threat Actors Weaponizing Open Source Packages to Deliver Malware in Supply Chain Attack

In the first half of 2025, cybersecurity experts have observed a significant rise in threat actors targeting the software supply chain through weaponized open source packages.

These attacks leverage the implicit trust developers place in third-party dependencies, transforming seemingly benign libraries into vehicles for delivering sophisticated malware like infostealers, remote shells, and cryptocurrency drainers.

Modern software development practices have created an expansive attack surface, with 70-90% of typical codebases consisting of third-party packages.

With billions of downloads occurring weekly from registries like npm and PyPI, attackers have identified a fertile ground for malware distribution, exploiting the complexity where a single package can pull in dozens of nested dependencies.

Socket.dev researchers identified multiple campaigns where threat actors deployed malicious code across major package ecosystems, including npm, PyPI, and Go Module.

Their analysis revealed how attackers are exploiting the interconnectivity of modern package ecosystems, where developers almost never inspect every transitive dependency, and automated CI pipelines may blindly install the latest versions.

The impact of these supply chain attacks extends far beyond individual developers, affecting organizations worldwide that unknowingly incorporate compromised packages into their products.

As AI-assisted development accelerates code integration without thorough inspection, the risk continues to grow, with attackers adapting their techniques to bypass traditional security measures.

Typosquatting campaign (Source – Socket.dev)

Among the various techniques employed by threat actors – including typosquatting, repository abuse, obfuscation, and weaponizing legitimate services – multi-stage malware deployment stands out for its effectiveness in evading detection while maximizing impact.

Multi-Stage Malware: Deferred Payloads and Staged Execution

Multi-stage malware segments functionality across several payloads, starting with lightweight code that appears harmless during initial scanning.

In one campaign linked to North Korean threat actors, Socket.dev researchers discovered a package delivering a loader called “BeaverTail” that stole browser data and cryptocurrency wallet credentials before fetching a more advanced backdoor named “InvisibleFerret”.

The first-stage code demonstrates the stealthy approach used:-

async function uploadFiles(basePath, prefix, includeSolana, timestamp) {
    if (!testPath(basePath)) return;
    for (let i = 0; i  {
        if (!error) {
            // Extract and execute
        }
    });
}

This deferred execution strategy keeps initial code small and less suspicious, while allowing threat actors to maintain persistence and execute more damaging payloads later.

By hiding in plain sight within trusted development workflows, these supply chain attacks represent a growing threat requiring specialized detection techniques focused on behavioral signals rather than static signatures.

How SOC Teams Save Time and Effort with ANY.RUN - Live webinar for SOC teams and managers

The post Threat Actors Weaponizing Open Source Packages to Deliver Malware in Supply Chain Attack appeared first on Cyber Security News.