Someone regularly creates malicious copies of the noblox.js package and gives them names that are very similar to the real one.

Since the beginning of September this year, Josh Muir, along with five other developers of the noblox.js package, has been trying hard to prevent cybercriminals from spreading ransomware through malicious libraries with similar names.

Noblox.js is a Roblox API wrapper that allows players to automate interactions on the popular Roblox gaming platform. However, in recent months, someone has been regularly creating malicious copies of the package and giving them names that are very similar to the real one.

Attackers use the so-called typesquatting – they come up with names that differ from the original by one or two characters, and hope for the inattention of potential victims. The malicious packages are uploaded to NPM (an open source JavaScript library repository), and then the files infected by them are distributed through Discord.

Last month, specialists from the information security company Sontatype reported on the malicious “counterparts” of noblox.js. According to them, there is no question of an attack on the supply chain in this case, and the malicious packages were created for fun. Muir, however, disagrees.

“I know Sonatype described this attack as a likely ‘joke’, but I assure you, this is not a joke, but a sustained and ongoing attack on our library and its users,” Muir told The Register.

The developer is aware of the existence of six malicious “twins” of the noblox.js library: noblox.js-rpc, noblox.js-proxy, noblox.js-beta, noblox.js-promise, noblox.js-promises, and discord.buttons-js. They have all been removed by now.

Sonatype Senior Security Researcher Ax Sharma confirmed to The Register that the company continues to capture more and more malicious NPM packages, including those with names similar to noblox.js. The last package uploaded was noblox.js-rpc, and was authored by the same person who previously uploaded the “evil counterparts” of noblox.js to NPM, which distributed ransomware. The same person runs the Discord server to exchange information about infected repositories and receive a ransom from the victims.

Muir is particularly concerned about the fact that most of the users downloading these malicious packages are children. Attackers distribute malware by registering on Discord servers where very young players “sit” (some are under 13) and rubbing their trust.

According to the developer, he has reason to believe that at least one minor was blackmailed using files stolen from him (the Discord administration was notified of this). And if NPM reacts to reports of malicious libraries and removes them, Discord doesn’t show much responsibility. As Muir explained, if an attacker deleted his original message, then bribes are smooth from him. If he regularly deletes his posts or uses alternative accounts, then Discord will not catch him.

…