Ankura CTIX FLASH Update - May 16, 2025

Malware Activity

Malicious npm Package Evades Detection and Delivers Sophisticated Multi-Stage Payload

Researchers have uncovered a sophisticated malware campaign involving a malicious npm package named "os-info-checker-es6", which poses as a system utility but stealthily delivers a multi-stage payload using advanced obfuscation and command-and-control (C2) evasion techniques. First published on March 19, 2025, the package was initially benign but evolved significantly by May 7, with version 1.0.8 introducing Unicode-based steganography to hide a C2 mechanism that leverages Google Calendar short links as dead drop resolvers. The malicious code uses invisible Unicode Variation Selectors to conceal base64-encoded URLs, which are extracted from Google Calendar event metadata, decoded, and executed via eval(), potentially with encrypted payloads using HTTP headers for keys. The package also includes a simple persistence mechanism to avoid multiple instances.