BigSquatRat npm Package Campaign Analysis

Summary

The report profiles a malicious npm package, bigmathix, that installs a Node.js remote access trojan. It uses obfuscated multi-stage code to pull follow-on payloads from attacker-controlled GitHub content and aurevian.cloud. Detection is hindered by dynamic decryption keys and a required initializer argument that gates execution, consistent with a targeted supply-chain attack on JavaScript developers.

Investigation

Researchers deobfuscated the package to reconstruct a chain that spawns a child process, performs DNS resolution, and decrypts embedded URLs using derived keys. By brute-forcing the initializer value, they recovered a second-stage payload from aurevian.cloud, which introduced additional obfuscation in the final RAT logic. Analysts also correlated related GitHub repositories and additional npm packages published around similar timestamps to map campaign scope.

Mitigation

Avoid untrusted npm dependencies—especially newly published, low-download packages, or modules with abrupt version changes—and validate integrity via hashes/provenance controls. Monitor for suspicious child processes spawned by node.exe and unexpected outbound lookups to unknown domains. Apply egress filtering for aurevian.cloud, and alert on persistence such as Windows Run keys or Linux systemd services created by Node.js processes.

Response

If bigmathix is identified, isolate the endpoint, remove the package, and terminate spawned Node.js processes. Delete created Run keys or systemd units, block associated domains/IPs, and collect logs showing DNS, process ancestry, and network egress. Perform forensics to identify downloaded payloads and persistence such as wscript.exe launchers or scheduled services, then hunt across the environment for matching artifacts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre‑flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands:
  The attacker possesses a malicious JavaScript payload that needs the Node.js runtime to execute. To evade standard application whitelisting, they use wscript.exe—a native Windows script host—to launch node.exe indirectly, creating a parent/child relationship that matches the detection rule. The steps are:

  1. Drop a malicious script (malicious.js) that simply spawns node.exe with the payload.
  2. Create a wrapper JavaScript (launcher.js) that the Windows Script Host will execute; this wrapper uses WScript.Shell to run node.exe with the payload.
  3. Execute the wrapper via wscript.exe //B //Nologo launcher.js.
  4. The resulting process tree is wscript.exe → node.exe → malicious.js, generating the target telemetry.

• Regression Test Script:
  The following PowerShell script automates the entire chain on a Windows test host.

  # -------------------------------------------------
  # Regression Test – Node.js RAT execution via wscript
  # -------------------------------------------------
  
  # Variables
  $tempPath = "$env:TEMP"
  $launcherPath = Join-Path $tempPath "launcher.js"
  $payloadPath  = Join-Path $tempPath "malicious.js"
  $nodePath     = "C:Program Filesnodejsnode.exe"   # Adjust if installed elsewhere
  
  # 1. Write the malicious payload (simple console log for demo)
  $payloadContent = @"
  console.log('Malicious payload executed');
  // Real RAT code would be here
  "@
  $payloadContent | Out-File -FilePath $payloadPath -Encoding ASCII
  
  # 2. Write the launcher that wscript will run
  $launcherContent = @"
  var shell = WScript.CreateObject("WScript.Shell");
  // Execute node.exe with the malicious script
  var cmd = "`"$nodePath`" `"$payloadPath`"";
  shell.Run(cmd, 0, false);
  "@
  $launcherContent | Out-File -FilePath $launcherPath -Encoding ASCII
  
  # 3. Execute the chain via wscript
  Write-Host "Launching malicious chain..."
  wscript.exe //B //Nologo $launcherPath
  
  # Pause to allow telemetry to be captured
  Start-Sleep -Seconds 5
  
  # 4. Optional: verify node process is running (for manual observation)
  Get-Process -Name node -ErrorAction SilentlyContinue
  
  # -------------------------------------------------
  # End of regression test
  # -------------------------------------------------

• Cleanup Commands: Remove artifacts and terminate lingering processes.

  # Cleanup script – run after validation
  $tempPath = "$env:TEMP"
  Remove-Item -Path (Join-Path $tempPath "launcher.js") -ErrorAction SilentlyContinue
  Remove-Item -Path (Join-Path $tempPath "malicious.js") -ErrorAction SilentlyContinue
  
  # Kill any stray node.exe processes spawned by the test
  Get-Process -Name node -ErrorAction SilentlyContinue | Stop-Process -Force