DirtyBlanket: Fake Express npm Packages and a Self-Spreading Linux Worm

Looks for: Any process whose command line names the hellscripter Codeberg account, or a Wayback Machine URL wrapping a Codeberg URL. This covers the npm preinstall hook, the Node.js loader, the SSH-pushed copy of the worm on remote hosts, and the line the worm appends to AUR .install files. No platform filter: the hook runs on macOS and Windows too and only the payload is Linux-only, so a non-Linux hit still means the package was installed.

// HUNT: DirtyBlanket fetches from the hellscripter Codeberg repository
// MITRE: T1195.002, T1105, T1059.004
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon process telemetry (ProcessRollup2) on developer hosts, CI runners and Linux servers
// FALSE POSITIVES: an analyst or ticketing tool that merely quotes the account name in a command line. The Wayback-wrapped Codeberg branch is broader than this campaign, so review any hit that lacks the hellscripter string.
// LOOKBACK: 30d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/hellscripter|web\.archive\.org\/web\/https?:\/\/codeberg\.org/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine])

Looks for: npm, pnpm, yarn, bun or node command lines that install any of the nine package names. Matching is by name, not version, because the OSV records list later versions for several of the names (for example 5.2.2) beyond the 5.2.1 builds SafeDep analysed.

// HUNT: DirtyBlanket malicious package install
// MITRE: T1195.002, T1204.005
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon process telemetry (ProcessRollup2) on developer hosts and CI runners
// FALSE POSITIVES: a security tool or ticket search that passes a package name on its command line without installing it.
// LOOKBACK: 30d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(npm|npx|pnpm|yarn|bun|node)$/i
| CommandLine=/\b(install|add|i)\b.*\b(xeprews|express-javascript|express-nodejs|react-nodejs|exprdd|exprrdd|exptrdd|exptred|exptredd)\b/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine])

Looks for: A process whose image hash is the SafeDep-reported hash of the systemd-fontd CHAOS client, or the hash of linux.sh. linux.sh runs as a bash script, so Falcon will normally record the interpreter hash rather than the script hash. Treat the second value as a record for file scanners and a hit here as unlikely. Both hashes come from one analysis (SafeDep) and are held at detect.

// HUNT: DirtyBlanket known-bad hashes executing
// MITRE: T1219, T1105
// CONF: medium  FP: low  COST: low
// REQUIRES: Falcon process telemetry (ProcessRollup2) with SHA256HashData
// FALSE POSITIVES: none expected for the binary hash. The script hash will rarely appear as a process image.
// LOOKBACK: 90d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| SHA256HashData=/^(2c9dbc14809f1e1aebda114194368b002acf74c8760b88fc101f625d179793c2|65f0a95b24e30305146346cbc2452cfabadab9e1ca35053e1134b67c38919577)$/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, SHA256HashData, ParentBaseFileName, CommandLine])

Looks for: Linux processes whose image name is systemd-fontrenderd, systemd-fontcached or systemd-fontd, or whose image is the Tor Expert Bundle extracted under systemd-fontrenderd in the user's ~/.config/systemd/. Names are matched on the image basename, so the install path does not matter.

// HUNT: DirtyBlanket fake systemd font service processes
// MITRE: T1036.005, T1543.002, T1090.003
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon Linux sensor process telemetry (ProcessRollup2)
// FALSE POSITIVES: none known. Check the distro file list (rpm -qf, dpkg -S, pacman -Qo) for any binary this finds before dismissing it.
// LOOKBACK: 30d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Lin
| ImageFileName=/systemd-font(renderd|cached|d)$|systemd-fontrenderd\/tor\/tor$/i
| table([@timestamp, aid, ComputerName, UserName, ImageFileName, ParentBaseFileName, SHA256HashData, CommandLine])

Looks for: systemctl enabling or starting, and chattr setting the immutable flag on, any path or unit with the fake font-service names. The worm runs these as child processes of its script, so each one is an ordinary process event.

// HUNT: DirtyBlanket persistence via systemctl and chattr on fake font units
// MITRE: T1543.002, T1222.002
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon Linux sensor process telemetry (ProcessRollup2)
// FALSE POSITIVES: none known; the unit names are specific to this campaign.
// LOOKBACK: 30d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Lin
| FileName=/^(systemctl|chattr)$/i
| CommandLine=/systemd-font(renderd|cached|d)/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine])

Looks for: Linux executable-written events whose target file name is one of the three fake font binary names. The worm downloads the CHAOS client with curl -o to /usr/lib/systemd/systemd-fontrenderd (root) or ~/.config/systemd/systemd-fontcached (non-root).

// HUNT: DirtyBlanket fake font binary written to disk
// MITRE: T1105, T1036.005
// CONF: high  FP: low  COST: low
// REQUIRES: Falcon Linux sensor ELFFileWritten telemetry
// FALSE POSITIVES: none known.
// LOOKBACK: 30d (set with the console time picker)
#event_simpleName=ELFFileWritten
| TargetFileName=/systemd-font(renderd|cached|d)$/i
| table([@timestamp, aid, ComputerName, ContextBaseFileName, TargetFileName, SHA256HashData])

Looks for: As root, linux.sh installs tor openssh git npm and build tools in one package-manager call. This query matches the two exact command lines SafeDep documents. It breaks if the operator edits the list, so treat a miss as uninformative.

// HUNT: DirtyBlanket worm dependency bootstrap
// MITRE: T1059.004, T1105
// CONF: medium  FP: low  COST: low
// REQUIRES: Falcon Linux sensor process telemetry (ProcessRollup2)
// FALSE POSITIVES: a provisioning script that happens to install the same package set in the same order.
// LOOKBACK: 30d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Lin
| FileName=/^(apt-get|apt|pacman)$/i
| CommandLine=/install -y tor openssh-client git npm build-essential|-S --needed --noconfirm tor openssh git npm base-devel/i
| table([@timestamp, aid, ComputerName, UserName, FileName, ParentBaseFileName, CommandLine])

Looks for: Connections to 127.0.0.1:9050, the local Tor SOCKS port the worm exports as HTTP_PROXY, grouped by the initiating process. The CHAOS client reaches its onion C2 only this way, so the process name is the signal. Tor is legitimate software and the bundle is hunt-only, never a block. FP: Developers running Tor Browser tooling, torsocks, privacy-focused apps and some research hosts connect to 9050 legitimately. Exclude known process names and approved hosts.

// HUNT: DirtyBlanket Tor SOCKS use by a non-Tor process
// MITRE: T1090.003, T1573
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Falcon Linux sensor NetworkConnectIP4 telemetry
// FALSE POSITIVES: Tor-aware tools, privacy proxies and research hosts that use the local SOCKS port.
// TUNING: extend the ContextBaseFileName exclusion with approved Tor clients, and exclude approved research hosts by ComputerName.
// LOOKBACK: 14d (set with the console time picker)
#event_simpleName=NetworkConnectIP4
| event_platform=Lin
| RemoteAddressIP4=127.0.0.1
| RemotePort=9050
| ContextBaseFileName!=/^(tor|torsocks|torbrowser|firefox|firefox-esr)$/i
| groupBy([aid, ComputerName, ContextBaseFileName], function=[count(as=connections), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)], limit=1000)
| sort(connections, order=desc, limit=200)

Looks for: Which Linux hosts resolve Codeberg or the Wayback Machine, as a scoping pivot after Q1 or Q2. Both are legitimate services used by developers every day. This is context for a host you already suspect, not a detection, and it must never become a block on either domain. FP: Almost every developer workstation resolves both. Run it against a short list of suspect hosts, or restrict to servers and CI runners, which should not.

// HUNT: DirtyBlanket scoping pivot on Codeberg and Wayback Machine lookups
// MITRE: T1102, T1105
// CONF: low  FP: high  COST: medium
// REQUIRES: Falcon Linux sensor DnsRequest telemetry
// FALSE POSITIVES: legitimate developer use of Codeberg and the Wayback Machine.
// TUNING: run only against servers and CI runner groups, or add a ComputerName filter for the suspect host list from Q1 and Q2. Do not alert fleet-wide.
// LOOKBACK: 14d (set with the console time picker)
#event_simpleName=DnsRequest
| event_platform=Lin
| DomainName=/^(codeberg\.org|web\.archive\.org)$/i
| groupBy([aid, ComputerName, DomainName], function=[count(as=lookups), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)], limit=1000)
| sort(lookups, order=desc, limit=200)

Looks for: linux.sh runs ssh -o BatchMode=yes -o UserKnownHostsFile=<mktemp file> against every host in the collected known_hosts, once per key and per ssh_config path, so one infected host produces a burst of such processes. The query counts them per host. FP: Ansible control nodes, backup jobs and CI deploy steps also use BatchMode=yes. The temporary known_hosts file narrows this, but automation that does the same will still match.

// HUNT: DirtyBlanket SSH fan-out with BatchMode and a temp known_hosts file
// MITRE: T1021.004, T1552.004
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Falcon Linux sensor process telemetry (ProcessRollup2)
// FALSE POSITIVES: configuration-management and deploy automation that uses BatchMode with a temporary known_hosts file.
// TUNING: exclude approved automation hosts by ComputerName, or raise the threshold above the largest legitimate fan-out in your fleet.
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Lin
| FileName=/^ssh$/i
| CommandLine=/BatchMode=yes/i
| CommandLine=/UserKnownHostsFile=\/tmp\//i
| groupBy([aid, ComputerName], function=[count(as=ssh_attempts), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)], limit=1000)
| test(ssh_attempts >= 10)
| sort(ssh_attempts, order=desc, limit=200)

Looks for: With every private key, the worm runs list-repos over SSH against the AUR to find packages the key owner can push to, then clones, edits and pushes them. Ordinary AUR maintainers run list-repos rarely, and almost never from a CI runner or a server.

// HUNT: DirtyBlanket AUR list-repos over SSH
// MITRE: T1195.002, T1021.004
// CONF: medium  FP: low  COST: low
// REQUIRES: Falcon Linux sensor process telemetry (ProcessRollup2)
// FALSE POSITIVES: an AUR maintainer listing their own packages by hand.
// LOOKBACK: 30d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| event_platform=Lin
| FileName=/^ssh$/i
| CommandLine=/aur@/i
| CommandLine=/list-repos/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])

Looks for: The worm rewrites each package.json it finds with npm pkg set scripts.preinstall=... before running npm version patch and npm publish. This matches the injection step itself, so it still fires if the operator moves the payload to a different host. FP: Developers occasionally set a preinstall script with npm pkg set. Review the value being set: a curl piped to node or a shell is the signal.

// HUNT: DirtyBlanket npm preinstall injection
// MITRE: T1195.002, T1059.007
// CONF: medium  FP: medium  COST: low
// REQUIRES: Falcon process telemetry (ProcessRollup2) on developer hosts, CI runners and servers
// FALSE POSITIVES: developers or release tooling that set a legitimate preinstall script with npm pkg set.
// TUNING: exclude approved release-automation hosts, and rank hits whose CommandLine contains curl, wget or a pipe to a shell or node.
// LOOKBACK: 30d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(npm|node)$/i
| CommandLine=/pkg\s+set\s+scripts\.preinstall/i
| table([@timestamp, aid, ComputerName, UserName, ParentBaseFileName, CommandLine])

Looks for: The worm launches one npm publish per .npmrc it finds, for every project directory it finds. Several publish commands from one host within the lookback, outside your release pipeline, indicate token misuse. FP: Monorepo releases and release pipelines publish many packages by design. Developer laptops should publish rarely.

// HUNT: DirtyBlanket npm publish fan-out
// MITRE: T1195.002, T1552.001
// CONF: medium  FP: medium  COST: medium
// REQUIRES: Falcon process telemetry (ProcessRollup2) on developer hosts, CI runners and servers
// FALSE POSITIVES: monorepo release jobs and publish pipelines.
// TUNING: exclude the named release-pipeline hosts and service accounts by ComputerName, and review developer laptops first.
// LOOKBACK: 7d (set with the console time picker)
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| FileName=/^(npm|node)$/i
| CommandLine=/\bpublish\b/i
| groupBy([aid, ComputerName], function=[count(as=publishes), min(@timestamp, as=first_seen), max(@timestamp, as=last_seen)], limit=1000)
| test(publishes >= 3)
| sort(publishes, order=desc, limit=200)