This week Sonatype identified 17 npm packages, at least 12 of which directly target John Deere’s private npm dependencies via dependency confusion, a technique that continues to repeatedly be employed by bug bounty hunters and malicious actors alike when targeting open source packages.

John Deere, or more specifically, Deere & Company, is a U.S.-based global producer of agricultural equipment including machines, tractors, and engines, as well as provider of financial services.

The discovery was made by Sonatype’s automated malware detection bots, offered as a part of Nexus Firewall.

Dozens of npm packages target John Deere

At least a dozen of these npm packages attempt dependency confusion against John Deere’s repos:

1. competitive-equipment-icon
2. deere-map-features
3. deere-ui-asset-events
4. deere-ui-basic-dialog
5. deere-ui-branding-ag
6. deere-ui-domain-framework
7. deere-ui-domain-framework-mixins
8. deere-ui-framework
9. deere-ui-icons
10. deere-ui-loader
11. deere-ui-modal-core
12. deere-ui-multiselect
13. deere-ui-toggle-group
14. equipment-color
15. eslint-config-cap-it-ui
16. machine-mapper
17. shaikh-test

All of these packages were published from the same npm account ‘shaikhyaser’:

All of these packages contain identical code that is the “standard” dependency confusion proof-of-concept (PoC) exploit we’ve previously seen:

Some of the “deere-*” packages could be vaguely traced to private github.deere.com domain where John Deere’s private GitHub repository appears to exist. But, more information was revealed by the maintainer of the npm account publishing these packages.

Ethical hacker behind these packages

Ethical hacker and bug bounty hunter Shaikh Yaser, formerly named as a Department of Defense VDP Researcher of The Month confirmed to us that the npm account was indeed his, and these packages were published to ethically target John Deere’s internal dependencies, with the hope of winning a bug bounty.

“Yes. It’s a security research on the dependency confusion. The package will execute only whoami and hostame commands,” Yaser told us in a statement.

But, the attempt doesn’t seem to have succeeded just yet.

“I have not got any callbacks form John Deere network. (Read more...)